Company: NEWTP
Filing Date: 2025-08-13
Form Type: 424B2
Source: 0001587987-25-000144
Chunk: 104

Company: NewtekOne, Inc.
Filing Date: 2025-08-13
Form: 424B2
Chunk 104
---
 these and other operational risks as certain aspects of the security of such technologies may be complex and unpredictable. It is critical to our business strategy that our facilities and infrastructure remain secure and are perceived by the marketplace to be secure.

We maintain a cybersecurity risk management program that is overseen by the Chief Information Security Officer (“CISO”) of NTS. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the board of directors of Newtek Bank understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to the Board and the board of directors of Newtek Bank on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.

Although we believe we and our IT providers employ appropriate security technologies (including data encryption processes, intrusion detection systems), and conduct comprehensive risk assessments and other internal control procedures to assure the security of our and our customers’ data, we cannot guarantee that these measures will be sufficient for this purpose. If our and our IT provider’s security measures are breached as a result of third-party action, employee error or otherwise, and as a result our or our customers’ data becomes available to unauthorized parties, we could incur liability and our reputation would be damaged, which could lead to the loss of current and potential customers. If we experience any breaches of our network security or sabotage, we might be required to expend significant capital and other resources to detect, remedy, protect against or alleviate these and related problems, and we may not be able to remedy these problems in a timely manner, or at all. Because techniques used by outsiders to obtain unauthorized network access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. For example, in early 2018, an unauthorized third-party misappropriated three of NTS’ domain names. NTS’ management and forensic investigators determined that attackers compromised a portion of NTS’ shared webhosting system, and may have acquired certain customer information limited to its shared webhosting customers, and/or gained access to certain of its shared webhosting servers. In response, NTS has taken a range of steps designed to further