Company: BWFG
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001505732-25-000052
Chunk: 76

Company: Bankwell Financial Group, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1C
Chunk 76
---
Item 1C.    Cybersecurity

Cybersecurity Risk Management and StrategyThe Company’s risk management program for cybersecurity is integrated into our risk management and general compliance programs and processes. Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. Our Information Security Officer ("ISO") is responsible for the day-to-day management of the Company’s global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The information security team also develops training for employees to support adherence to the Company’s policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.The Company leverages the U.S. Department of Commerce’s National Institute of Standards and Technology Cybersecurity Framework ("the NIST Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The Company’s ISO works with independent, third-party consultants to assess the maturity of the Company’s cybersecurity program within the NIST Framework and to develop strategic areas of focus for the Company’s program commensurate with the Company’s business objectives.As part of the Company’s information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, we maintain a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to our system, facilities, and/or confidential or proprietary data.

Cybersecurity incidents may create risk to the Company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most corporations, the Company is the target of industrial espionage, including cyberattacks, from time to time. The Company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, the Company has not experienced any known cybersecurity incidents that have materially affected the Company, including