Company: CMTV
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001654954-25-003447
Chunk: 125

Company: COMMUNITY BANCORP /VT
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1C
Chunk 125
---
The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to:  ·Cyber-attacks: We are vulnerable to cyber-attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses. ·Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property. ·Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation. ·Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage. ·Reputation Risk: A significant cybersecurity incident could damage the Company’s reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities. ·Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies. ·Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage.

We have implemented a comprehensive Information Security Program to mitigate these risks, which includes:  ·Regular risk assessments and vulnerability testing of systems and networks. ·Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols. ·Employee training and awareness programs to enhance cybersecurity awareness and promote best practices. ·Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.

The Information Security Program is led by the Company’s Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant.  Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk