Company: CMTV
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001654954-25-003447
Chunk: 17

Company: COMMUNITY BANCORP /VT
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1
Chunk 17
---
 set off or transferred in any manner without a license from OFAC.  We maintain an OFAC program designed to ensure compliance with OFAC requirements.

Cybersecurity. Federal regulators have issued various guidance relating to cybersecurity, including a statement indicating that banks should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing a bank’s internet-based services.  Regulators have also issued guidance indicating that they expect a bank's management to maintain a sufficient business continuity planning process to ensure rapid recovery, resumption, and maintenance of the bank's operations after a cyber-attack involving destructive malware. A bank is also required to develop appropriate processes to enable recovery of data and business operations, address rebuilding network capabilities, and restore data if the bank or any of its critical service providers fall victim to this type of cyber-attack. If we do not comply with this regulatory guidance, we could be subject to various regulatory sanctions, as well as financial penalties.

In 2021, the federal bank regulatory agencies issued a final rule requiring banks that experience a computer-security incident to notify certain entities. A computer-security incident occurs when actual or potential harm to the confidentiality, integrity or availability of information or the information system occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the computer-security incident that has occurred. These notifications are intended to promote early awareness of threats to banks and to help contain them in a timely fashion. This rule also requires bank service providers to notify their customers of a computer-security incident.

Additional information regarding cybersecurity matters is contained in Part I, Section 1C of this report.

Financial Privacy. Under the federal Gramm-Leach-Bliley Financial Modernization Act of 1999 all financial institutions, including the Company, are required to adopt privacy policies, restrict the sharing of nonpublic consumer customer data with nonaffiliated parties, and establish procedures and practices to protect customer data from unauthorized access.  The Company is also subject to similar, but more stringent, requirements under state law, including the Vermont Financial Privacy Act.  In addition, we are subject to the federal Fair Credit Reporting Act, including the amendments adopted in the federal Fair and Accurate Credit Transactions Act of 2003 (FACT Act).  The FACT Act includes many provisions concerning national credit reporting standards and permits consumers to opt out of information sharing among affiliated companies for marketing