Company: FCAP
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001171843-25-001868
Chunk: 896

Company: FIRST CAPITAL INC
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1C
Chunk 896
---
The Company’s cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with input from our Board of Directors, proactively manages the Company’s cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Company has appointed a Chief Information Officer (“CIO”) to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. This includes regular consultation with external cybersecurity experts. In addition, we participate in external tabletop exercises on a regular basis in addition to conducting our own internal tests of our systems. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

The Company uses a Disaster Recovery Plan (the “Plan”), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team (“CMT”). The CMT facilitates coordination across key stakeholders of the Company. The Company’s CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality,