Company: BANFP
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-030159
Chunk: 18

Company: BANCFIRST CORP /OK/
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 18
---
-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, the Company, BancFirst, Pegasus and Worthington have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Company, BancFirst, Pegasus and Worthington's systems and those of their customers and third party service providers are under constant threat and it is possible that the Company, BancFirst, Pegasus and Worthington could experience a significant event in the future.

Federal banking agencies, including the Federal Reserve Board and the FDIC, issued a rule to improve the sharing of information about cyber incidents. Under the rule a banking organization’s primary federal regulator must receive notification as soon as possible and no later than 36 hours after the banking organization determines that a significant computer-security incident, known as a “notification incident,” has occurred. Further, the rule separately requires a bank service provider to notify each of its affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Under the Federal Trade Commission's amendments to the Gramm-Leach-Bliley Act's Safeguards Rule financial institutions are required to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors.

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of risk management strategies and governance processes related to cybersecurity.

Fiscal and Monetary Policies 

The Company’s business and earnings are affected significantly by the fiscal and monetary policies of the federal government and its agencies. The Company is particularly affected by the policies of the Federal Reserve Board, which regulates the supply of money and credit in the United States. Among the instruments of monetary policy available to the Federal Reserve Board are (a) conducting open market operations in United States government securities, (b