Company: BCTF
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0001552781-25-000058
Chunk: 53

Company: Bancorp 34, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1
Chunk 53
---
 annual basis. The board has delegated the
primary review of our cybersecurity, disaster recovery and business continuity risk management framework and related policies and procedures
to the board-level Information Security Committee, which reports and makes recommendations to the board of directors in these regards.
Senior management is responsible for establishing, implementing, maintaining and testing our policies and procedures related to cybersecurity,
disaster recovery and business continuity and provides reports on these matters to the Information Security Committee. The Information
Security Committee reports its activities to the full board of directors.

While we have implemented
a cybersecurity, disaster recovery and business continuity risk management framework to mitigate our loss and risk exposure, there is
no assurance that such framework will be effective under all circumstances. Failures in our governance oversight of cybersecurity, disaster
recovery and business continuity risk management framework could cause us to be more vulnerable to cyber attacks and disruptions to our
systems supporting customer activities, such as our online banking and mobile application which could result in disruptions to our business,
result in the disclosure or misuse of confidential proprietary information, damage our reputation, increase our costs and cause losses.
Risks associated with cybersecurity and disruptions to our operations are further addressed in these Risk Factors under the Caption Operational
Risks.

39

Our
risk management framework may not be effective in mitigating risks and/or losses.

We have implemented
a risk management framework to mitigate our risk and loss exposure. This framework is comprised of various processes, systems and strategies,
and is designed to identify, measure, monitor, report and manage the types of risk to which we are subject, including, among others,
credit risk, interest rate risk, liquidity risk, legal and regulatory risk, compliance risk, strategic risk, reputational risk and operational
risk related to our employees, systems and vendors, among others. Any system of control and any system to reduce risk exposure, however
well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the
objectives of the system are met and will be effective under all circumstances or that it will adequately identify, manage or mitigate
any risk or loss to us. Additionally, instruments, systems and strategies used to hedge or otherwise manage exposure to various types
of interest rate, price, legal and regulatory compliance, credit, liquidity, operational and business risks and enterprise-wide risk
could be less effective than anticipated. As a result, we may not be able to effectively mitigate our risk exposures in particular market
environments or against particular types of risk. If our risk management