Company: ISBA
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000842517-25-000053
Chunk: 30

Company: ISABELLA BANK CORP
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 30
---
 systems; misappropriation of confidential information related to customers, counterparties, employees, or other parties; severe damage to our reputation; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated, or destroyed, or the inability to prevent systems from processing fraudulent transactions; violations of applicable privacy and other laws; financial loss to us or our customers, counterparties, or employees; exposure to the risk of litigation, regulation, and other liability, which may include fines or other penalties and increased cybersecurity or other insurance premiums.  The extent of a particular cyber-attack and the steps we must take to investigate and respond to it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed.

We have cybersecurity insurance intended to cover expenses related to notification, credit monitoring, investigation, crisis management, public relations, and legal advice.  In addition, we maintain insurance to cover restoration of data, certain physical damage, and third-party injuries caused by potential cybersecurity incidents.  However, damage and claims arising from such incidents may not be covered or may exceed the amount of any insurance available.  Insurance policies and coverage are reviewed at least annually in detail.

Risk Management 

Cybersecurity threats are assessed, identified, and managed within our Enterprise Risk Management Framework.  We use a multi-layered approach to effectively manage risk.  This approach includes, but is not limited to: (1) employees who are responsible for and manage risk; (2) employees and systems that oversee, monitor, and report risk: and (3) independent assurance, evaluation, and oversight of risk management activities.

Our security strategy is a layered approach.  We utilize multiple layers of defense, both internally and externally, to ensure the integrity of our systems and data.  We engage reputable security partners (assessors, consultants, auditors, and other third parties) for real time analysis and protection of our network infrastructure.  This includes the use of preventative and detective tools to monitor, block, and alert us to suspicious activity.   We utilize industry and regulator recognized assessment tools, such as the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool, to identify potential cybersecurity 

13

Table of Contents

threats as well as the impact they could have on the Bank.  Dashboards are used to track and monitor cybersecurity activity and trends.

We have established programs in place to proactively mitigate and respond to cybersecurity risk.  The Vendor Management Program