Company: SFBC
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001541119-25-000009
Chunk: 95

Company: Sound Financial Bancorp, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1C
Chunk 95
---
 oversees cybersecurity risk management as part of its broader risk oversight responsibilities. The Board receives at least annual reports from the ISSC on cybersecurity risks, emerging threats, regulatory developments, and the effectiveness of our information security program. The Board also reviews and approves the ISP annually to ensure alignment with business strategy and regulatory requirements.

The ISSC, chaired by the vCISO, is responsible for implementing cybersecurity risk management policies and strategies. The vCISO, appointed by the Board, has extensive experience in information security, holding various professional certifications, including a Certified Information Systems Security Professional (“CISSP”). The ISSC also includes senior executives from risk, compliance, IT, and internal audit functions, ensuring a multidisciplinary approach to managing cybersecurity threats.Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISSC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually. The ISSC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists.The ISSC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives. 

Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery.