Company: FMFG
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001437749-25-007333
Chunk: 42

Company: Farmers & Merchants Bancshares, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 42
---
Compliance Officer completed a comprehensive self-assessment of the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (“ CAT”). The CAT is developed by the Financial Service Sector Coordinating Council and is aligned to the NIST Cybersecurity framework in the identification of organizational risks and determination of cybersecurity preparedness. These assessments take into account our organizational characteristics and actual and perceived external threats and evaluate, among other things, how those threats could impact and be impacted by our technologies and connection types, our delivery channels, our online and mobile banking products and other electronic banking services, our risk management oversight and controls, our dependence on outside vendors and how we manage those relationships, and our cybersecurity incident management process. The Company’s third-party information technology network security consultant reviews the completed CAT reports, along with our annual information technology risk assessment audit reviews.

Cybersecurity Defense Approach

We deploy and maintain a layered cybersecurity defense approach to securely protect our network computer systems, software applications, and stored data/information resources. As a first layer of defense, we employ a multi-faceted firewall and replication of primary and backup servers in our computer network. The Company receives daily and weekly reports and cybersecurity activity alerts, which are reviewed by our network administration management team. Our President and our Information Technology Security/Compliance Officer present quarterly Customer Data & Information Systems Security Program report updates to our boards of directors and their joint Executive Committee.

Third-Party Vendor Management

In accordance with the FDIC’s information technology (“ IT”) compliance requirement for an annualvendor risk management program, the Bank developed a vendor management policy and performs an annual risk assessment review. This comprehensive review of mission-critical bank industry and network security vendors includes annual review of vendor compliance reports performed by accounting and audit firms, reviews of annual financial reports for vendors, and risk assessment reviews encompassing vendor performance, information technology compliance, operations, quality of service and support, contractual compliance, and business resumption contingency plans. These annual vendor management risk assessments are evaluated by the bank’s designated Information Technology Security/Compliance Officer for review and authorization by the bank’s President and senior information technology management, with final presentation, review, and approval by the Board of Directors. Complementing the Bank’s vendor risk assessment review and program, are additional risk assessment evaluations including the FDIC Risk Assessment, inclusive of network systems risk assessment, customer information systems risk assessment, and electronic banking vendor management risk assessment. Additionally, the Bank maintains a disaster recovery policy and conducts annual disaster recovery testing with respect to its mission-critical software vendor applications, as well as