Company: NEWTP
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001587987-25-000050
Chunk: 180

Company: NewtekOne, Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1C
Chunk 180
---
 our CTO. Our CTO and the CISO, who is employed by IPM, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to our CTO who reports to the Technology Steering Committee on a quarterly and more frequently as needed, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management’s presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee. 

66

Table of Contents

While our Board and Technology Steering Committee oversee cybersecurity and technology risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within IPM, with oversight by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO’s team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the CTO, who coordinates with the Company’s and our subsidiaries’ executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Technology Steering Committee the effectiveness of the Company’s technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.

Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He