Company: BCTF
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0001552781-25-000058
Chunk: 592

Company: Bancorp 34, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1C
Chunk 592
---
, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines.
We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential
future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party
to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers’ cybersecurity
practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity
and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information.
Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any
such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed
to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense
of an incident we maintain cyber insurance.

Due
to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the
future. Potential risks we could face from a cybersecurity event are discussed in “Risk Factors” above.

53

Governance

Through established
governance structures, including our problem and incident management process and incident response plan, we have processes and procedures
to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense
and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management,
our board-level Information Security Committee, or to the full Board, as appropriate.

Role
of the Board of Directors

Our
Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a
risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.
Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk
management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management
framework on an annual basis.

Our
Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external
auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters