Company: BCTF
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0001552781-25-000058
Chunk: 591

Company: Bancorp 34, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1C
Chunk 591
---
Overview

The
cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity
risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological
attacks that impact the confidentiality, integrity, or availability of our or third parties’ operations, systems, or data. We seek
to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things:

    ·
    maintaining privacy policies, management
    oversight, accountability structures, and technology design processes to protect private and personal data;

    ·
    actively monitoring and mitigating cybersecurity
    threats and risks with a defense structure to provide oversight, governance, challenge, and testing;

    ·
    using a third-party cybersecurity oversight program
    to effectively discover, analyze and understand cyber threats;

    ·
    maintaining oversight of our information security
    program by senior management, our board-level Information Security Committee, and our Board of Directors;

    ·
    establishing and maintaining a comprehensive program
    to oversee and manager external connections and third-party relationships with access to the institution’s technology assets
    and information; and

    ·
    maintaining an incident response program intended
    to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external
    stakeholders, as needed.

We
experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of
two of our employees. We notified the affected customers of the incident in early September 2023 and have taken steps to mitigate our
and our customers’ exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the
cybersecurity incident.

Risk
Management and Strategy

Our
cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as
outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer
information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate
known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms.
We implement backup and recovery systems and require the same of our critical third-party service providers.

We use independent
third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of
our controls