Company: NEWTP
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001587987-25-000050
Chunk: 179

Company: NewtekOne, Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1C
Chunk 179
---
Table of Contents

Engagement of Assessors, Consultants, and Auditors:1.Internal Expertise: Our CTO is responsible for overseeing the Company’s IT infrastructure and cybersecurity and reports to our executive management team and the Technology Steering Committee of our Board.2.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. Historically, the Company’s subsidiary NTS and its team of professionals, including NTS’ Chief Information Security Officer (“CISO”), who currently serves as our CISO, and CTO, and their team of professionals, have managed the Company’s IT infrastructure, including our dedicated server hosting, managed cybersecurity, backup and disaster recovery, and other related services. As of the January 2, 2025, close of our divestiture of NTS to IPM, we and IPM entered into a Master Services Agreement pursuant to which IPM provides us with the same services NTS provided to the Company prior to the divestiture. Our CTO is responsible for overseeing IPM’s provision of the managed technology services, including cybersecurity, to NewtekOne. In addition, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.3.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.Oversight of Third-Party Service Providers:Our management is actively engaged in overseeing our third-party service providers. Our Enterprise Third Party Risk Management (TPRM) Policy establishes requirements and practices used to oversee and manage the activities of third parties with whom we have a relationship, under which we identify, measure, monitor, and manage third-party risk (including information cybersecurity risks) in alignment with our strategic objectives and in compliance with applicable law. Any identified threats, vulnerabilities, or cybersecurity incidents are addressed as appropriate through our CTO, CISO and IPM.

GovernanceOur Board oversees material risks facing the Company. For some categories of risk, the Board has empowered committees to provide more focused oversight. In the case of cybersecurity and technology risk, in 2024 the Board formed the Technology Steering Committee which has that responsibility.The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company’s management, including