Company: MCHB
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0001518715-25-000026
Chunk: 37

Company: Mechanics Bancorp
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1C
Chunk 37
---
ITEM 1C      CYBERSECURITY

Cybersecurity Risk Management and Strategy:

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things:•conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K;•running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies;•regular cybersecurity training programs for employees, management and directors; conducting annual customer data handling training for all our employees;•conducting annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;•comparing our processes to standards set by the National Institute of Standards and Technology (“NIST”), International Organization for Standardization (“ISO”), and Center for Internet Security (“CIS”);•leveraging the NIST cybersecurity framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident;•operating threat intelligence processes designed to model and research our adversaries;•closely monitoring emerging data protection laws and implementing changes to our processes designed to comply;•undertaking regular reviews of our consumer facing policies and statements related to cybersecurity;•proactively informing our customers of substantive changes related to customer data handling;•conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;•through policy, practice and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care;•maintaining a