Company: BCTF
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0001552781-25-000058
Chunk: 435

Company: Bancorp 34, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1B
Chunk 435
---
 reports on risk, examination, and regulatory compliance matters.

The
Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity
risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management
members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity
threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework.
The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and
regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular
summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as
needed, in accordance with our Incident Response Plan and Business Continuity Plan.

 Role
of Management

Senior
management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity,
disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee
reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed
to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating
the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.

Our
framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against
cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness
is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security
awareness emails from the VP of IT Operations. Our cybersecurity risk management program is designed to maintain and challenge our information
security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.

54

Our
Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party
provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer,
Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with
over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.
The Committee is responsible for