Company: FMFG
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001437749-25-007333
Chunk: 43

Company: Farmers & Merchants Bancshares, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 43
---
 performs an annual business impact analysis that evaluates each mission-critical vendor in a prioritized hierarchy of hardware and software restoration relative to specified recovery time objectives and recovery time objectives in accordance with the FDIC’s information technology compliance requirements.

24

Incident Response Program

In accordance with the FDIC’s requirement for development of an annual IT incident response policy, the Bank maintains an incident response and computer forensics policy. This policy is reviewed on an annual basis and updated as necessary by the Bank’s President and its Information Technology Security/Compliance Officer and then presented for review and approval by the Bank’s Board of Directors. The policy is also reviewed as part of an annual network security risk assessment audit conducted by the Bank’s IT security consultant and by the FDIC and the Maryland Commissioner when they conduct their IT examinations. The Bank has established incident alert levels, response and recovery timeframes, and computer forensics procedures for cybersecurity attack events, data breaches of sensitive information, systems failures and alerts, and corresponding customer and key contact notification including regulatory, vendors, local authorities, and bank directors/employees. The Bank annually contracts with a third-party industry expert vendor to provide computer forensics guidance and escalated support in the event of a cybersecurity incident when such vendor’s expertise and resources are needed.

Security Awareness and Training

The Bank maintains a program led by our Information Technology Security/Compliance Officer that is intended to comply with the FDIC’s requirement for annual network security training of all employees. This training program includes a comprehensive network security overview, including phishing and ransomware awareness training, a summary review of the Bank’s disaster recovery and pandemic plans, and an annual renewal and authorization of an employee network acceptable use policy. In addition, the Bank’s IT management and network administrators attend periodic training programs and certifications, review regulatory compliance and industry IT security briefs, and participate in vendor application quality assurance reviews. Finally, we provide our customers with information about cybersecurity awareness and electronic banking security practices, phishing and malware awareness, and fraudulent scams targeting customers on our dedicated website.

  ITEM 2.      PROPERTIES  
 ───────────────────────────

The Bank owns properties at which it operates branches at the following locations:

  Main Office                 Owings Mills Branch          Eldersburg Branch     
  15226 Hanover Pike          9320 Lakeside Boulevard      1321 Liberty Road     
  Upperco, MD 21155           Owings Mills, MD 21117       Eldersburg, MD 21784  
 ─────────────────────────────────────────────────