Company: FFWM
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001558370-25-003129
Chunk: 18

Company: First Foundation Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1C
Chunk 18
---
Item 1C.   Cybersecurity. 

​

Cybersecurity Risk Management

​

We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving our enterprise value.  We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.  The Company’s Information Security Officer is primarily responsible for developing, monitoring, and implementing our cybersecurity program, which establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations.  The Chief Technology Officer is responsible for implementing the appropriate controls and monitoring them towards adherence with the established standards.  ​As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the Gramm-Leach Bliley Act of 1999 and Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool.  Our processes for identifying, assessing and managing material risks from cybersecurity threats rely on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls.  As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident.  We also review and test our incident response plan through simulations and assessments.  Further, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.​We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third-party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our Information Security Program team’s protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.

​

Our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A—“Risk Factors” of this Annual Report on Form 10-K.

​

Cybersecurity Governance

​

The Board of Directors, through the Audit Committee and Directors’ Risk Committee, provides direction and oversight of the Company’s risk management system. Our Chief Technology Officer is responsible for managing our