Company: PFIS
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001558370-25-003995
Chunk: 17

Company: PEOPLES FINANCIAL SERVICES CORP.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1C
Chunk 17
---
Item 1C.Cybersecurity.

Cybersecurity Risk Management and StrategyThe current threat environment from phishing emails to cyber-attacks has created an urgent need for increased awareness on cyber and information security. Peoples and the Bank take a risk-based approach to managing these threats. The Bank’s leadership team and its Board of Directors engages in the management of this risk by participating in the information security and cybersecurity strategy and review process. Cyber and information security programs are designed around industry best practices. Compliance with these best practices along with federal and state regulatory requirements are examined annually by the Department of Banking and the FDIC and we regularly engage third-party external auditors and consultants to assess our compliance. Our cyber defense strategy includes continuous monitoring, integrated risk assessment, identification of vulnerabilities and human risk factors, and employee awareness. Cybersecurity exercises with other financial services companies and government agencies help prepare the Bank for cybersecurity threats and incidents. Incident response scenarios and business continuity exercises test the organizations preparedness for disaster events. The organization also utilizes several national and global third party advisors to ensure the appropriateness of the Bank’s security posture, effective operation of the cybersecurity discipline and proper assessment of risk. 

Third-Party Risk Management

The Bank has an established third party information security risk management program that reviews and assesses third parties prior to engagement and throughout the third party relationship. This program requires periodic risk assessments to be conducted throughout the term of the engagement. Third parties and their employees are required to adhere to information security standards and best practices. The Bank includes in its contracts with third parties that third parties maintain confidentiality, security provisions and business continuity practices. 

Education and Awareness

Peoples Security Bank and Trust Company employees are required to complete training on customer information protection at least annually. They receive monthly training and testing on phishing emails and other timely information security topics. They are also required to abide by the Bank’s Code of Business Conduct and Ethics Policy. Annual review and acknowledgement of the employee’s information security responsibilities are required. Information security tips are provided on the Bank’s website for all customers to review. We provide additional information security advantages to our customers using our online banking systems and encourage the Bank’s digitally active business customers to take advantage of the cybersecurity and phishing training provided free of charge by the Bank. 

Material Effects of Cybersecurity Threats

While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, have, to date, materially affected the Company, including its business