Company: HBCP
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001436425-25-000012
Chunk: 120

Company: HOME BANCORP, INC.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 120
---
 training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks associated with our use of third-party service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a sizable portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, including the CROC. The Incident Response Plan is coordinated through the Director of Information Security and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned “Risks Related to Our Operational and Information Technology Systems” in Item 1A. Risk Factors.

Governance

Our Director of Information Security is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Director of Information Security, provides guidance, oversight, monitoring and challenging the first line’s activities. The second line of defense function is separated from the first line of defense function through organizational structure and reports directly to the Chief Risk Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are subject to professional education and certification requirements. Our Director of Information