Company: SFBC
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001541119-25-000009
Chunk: 93

Company: Sound Financial Bancorp, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1C
Chunk 93
---
Table of Contents

Item 1C.    Cybersecurity 

Risk Management and StrategyOur enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats.  Our cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council (“FFIEC”) Cyber Assessment Tool (“CAT”).The Company is committed to protecting the information of clients, employees, and stakeholders from both conventional and cyber threats. This commitment is upheld through the implementation of our comprehensive Information Security Program (“ISP”), designed to ensure the confidentiality, integrity, and availability of critical information technology (“IT”) systems and data. The Information Security Steering Committee (“ISSC”), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank’s business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer (“vCISO”), who is also appointed by the Board, oversees the ISP and coordinates the ISSC.The ISSC's responsibilities encompass: •Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments;•Monitoring of control statuses and program gaps, including findings from audit reports and assessments;•Participation in program assessments, such as risk and business impact assessments;•Providing input on mitigation of current issues and threats;•Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISSC activities and risk impacts on the Risk Appetite Statement.•Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.The Company’s approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the Company is effectively handling the inherent risks it