Company: ISBA
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000842517-25-000053
Chunk: 31

Company: ISABELLA BANK CORP
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 31
---
 provides management with a framework to evaluate new vendors and ensure ongoing monitoring of third parties, including the evaluation of cybersecurity risk.  The Incident Response Plan provides a framework for management to respond to and minimize the impact of an incident involving our information technology systems, or that of one of our third-party providers.  The Business Continuity Plan provides information to prepare for and manage a business disruption.

Governance

All employees play a critical role in managing cybersecurity risk.  Our Enterprise Risk Management Framework utilizes the three lines of defense model to define roles and responsibilities to effectively manage risk.  First line employees own and manage risk, the second line oversees, monitors, and reports risk, and the third line provides independent assurance of risk management activities.

We employ Information Technology staff to analyze and protect our network infrastructure.  Members of our IT staff have relevant training and education in computer networks and systems, information security and intelligence, and hold industry certifications related to network security, enterprise IT governance, and risk and information systems control.  In addition, our employees’ network with peer banks, participate in industry groups, and attend ongoing training to stay abreast of cybersecurity threats and best practices.

Within the Enterprise Risk Management Framework, we have established committees, both at the management and board level, to oversee risk, and ensure cybersecurity risk is escalated appropriately to the Board.

The Information Technology Risk Management Committee is chaired by the Chief Technology Officer and comprised         of IT management and other key stakeholders from across the Bank.  They are responsible for identifying, measuring, monitoring, and controlling risk generated within IT, including cybersecurity risk.  This committee reviews and updates risk assessments as necessary and monitors activity through risk reports and dashboards.  A cybersecurity dashboard, which includes a summary of key risk metrics, is reviewed and monitored by the IT Risk Management.  The Chief Technology Officer and Information Security Officer provide quarterly reports to the Board Risk Committee.

The Board Risk Committee assists the Board in fulfilling its responsibilities related to the oversight of the Bank’s     Enterprise Risk Management Framework.  The Board Risk Committee oversees executive management's design, implementation, and maintenance of an effective risk management program to ensure compliance with laws and regulations, and operation within the parameters established in the Bank’s risk appetite statement.  This includes a review of the cybersecurity dashboard which summarizes key risk indicators and identifies emerging risks.

The Board Risk Committee provides a verbal risk report and meeting minutes to the Board periodically. In addition, the full Board reviews the Risk Management processes and results, and the Board's Audit Committee tracks any corrective