Company: CCNE
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000736772-25-000071
Chunk: 32

Company: CNB FINANCIAL CORP/PA
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 32
---
 to damages if our third-party service providers fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

As of December 31, 2024, the Corporation has not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Corporation. However, there can be no assurance that the Corporation or its subsidiaries will remain unaffected in the future. Given the evolving nature of security threats and evolving safeguards, there can be no assurance that any preventive, protective, or remedial data security measures that we or our third-party service providers implement are or will be adequate to detect or prevent all cybersecurity incidents. The Corporation continues to enhance its data security systems, technology platforms, employee education and risk management processes, in an effort to underpin its business strategy as well as in response to the evolving threat landscape and any incidents we experience. In connection with these efforts, we have incurred costs and expect to incur additional costs as we continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. In addition, any actual or perceived failure by the Corporation or our vendors or business partners to comply with our privacy, confidentiality, or data security-related legal or other obligations to third parties may result in claims by third parties that we have breached our privacy- or confidentiality-related obligations, which could materially and adversely affect our business and prospects.

The Corporation’s risk and exposure to these matters, including future "phishing" attempts like the 2020 incident, which was disclosed in the Corporation's Annual Form 10-K for the year ended December 31, 2020, remain heightened because of, among other things, the evolving nature of these threats, our plans to continue to implement our Internet banking and mobile banking channel strategies and develop additional remote connectivity solutions to serve our customers when and how they want to be served. As a result, cybersecurity and the continued development and enhancement of the Corporation’s controls, processes and practices designed to protect its and its subsidiaries systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for the Corporation. As cyber threats continue to evolve, the Corporation may be required to expend further significant resources to continue to modify or enhance its protective measures or to investigate and remediate future information security vulnerabilities.

Additionally, while we have implemented security measures that we believe are appropriate, a