Company: MCHB
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0001518715-25-000026
Chunk: 38

Company: Mechanics Bancorp
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1C
Chunk 38
---
 risk management program for suppliers, vendors, and other third parties, which includes conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed; and•carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.These approaches vary in maturity across the business and we work to continually improve them.Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all Company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third parties, to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Information Technology" included as part of our risk factor disclosures in Item 1A of this Form 10-K.

16

In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

Governance

Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Board Enterprise Risk Management Committee ("ERMC") is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the ERMC receives an overview from management and the management steering committee of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, describing the company’s ability to mitigate those risks, and discussing such matters with our Chief Information Security Officer and Chief Information Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.