Company: CCNE
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000736772-25-000071
Chunk: 53

Company: CNB FINANCIAL CORP/PA
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1C
Chunk 53
---
 plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. However, there can be no assurance that the Corporation’s security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Corporation maintains cybersecurity insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that the Corporation’ cybersecurity insurance coverage will be sufficient in the event of a cyber attack. See “Item 1A. Risk Factors” above for more information. 

Governance

The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The boards of directors of the Corporation and the Bank have also established an IT Committee, consisting of at least three independent directors, along with non-voting members from management, including the President and CEO, the Chief Financial Officer, the CITSO, the SVP of Operations, the VP of Information Technology, and the VP of Information Security. The IT Committee assists the boards of directors of the Corporation and CNB Bank in fulfilling their respective governance responsibilities for CNB’s information technology and related data security infrastructure under relevant regulatory safety and soundness requirements. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee and IT Committee, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board of Directors. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks. Several members of the Board of Directors, including the Chairperson of the Audit Committee, also have cybersecurity experience.As described above, management is actively involved in assessing and managing the Bank’s material cybersecurity risks. The Corporation's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include the CEO, the CFO, the Board of Directors, the Audit Committee and external legal