Company: PNBK
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0001628280-25-017837
Chunk: 75

Company: PATRIOT NATIONAL BANCORP INC
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1C
Chunk 75
---
ITEM 1C. Cybersecurity

Cyber/information security is a significant and integrated component of the Company’s risk management strategy. As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.Cybersecurity Risk Management and Strategy:The Bank maintains comprehensive policies, procedures, internal controls and practices with respect to cyber/information security, including: •Information Security Policy and Risk Management.  The Bank maintains an Information Security Policy reviewed and updated as needed, and at least annually by its Board of Directors. •Information Technology & Information Security Audits.  The Bank conducts independent external and internal audits of internal controls relating to information technology and information security in accordance with standards established by the Federal Financial Institutions Examination Council (FFIEC). •Information Security Management.  To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank’s Information Security Program.  The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third-party risk management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster).  The Company engages qualified third-party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.•Employee Training and Awareness.  Our employees are the first line of defense with respect to cyber/information security protection. Each employee is responsible for protecting the Bank and customer information. Employees are provided with training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from cyber/information security threats and activities intended to compromise cyber/information security.

15

Table of Contents

•Customer Data Privacy Reviews.  The Bank conducts independent external and internal reviews