Company: PNBK
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0001628280-25-017837
Chunk: 76

Company: PATRIOT NATIONAL BANCORP INC
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1C
Chunk 76
---
 of internal controls relating to customer data privacy and data security in accordance with the requirements of the Gramm-Leach-Bliley Act, the Right to Financial Privacy Act, and standards established by the FFIEC. 

Cybersecurity Governance:

•Board Oversight.  The Audit Committees of the Company and the Bank review and monitor the effectiveness of the Bank’s internal controls, including those controls related to information security, based on independent external audit and internal audit reports.  The Boards of Directors of the Company and the Bank review a formal Information Security Report at least annually, a Gramm-Leach-Bliley Act (“GLBA”) report annually and receive periodic reports on cyber/information security topics and matters. As required by federal banking laws and regulations, the Bank’s cyber/information security risk management practices include risk assessments, controls, and practices specifically for cybersecurity, information technology deployment and third-party information technology vendor risk management. 

•CIO Responsibilities.  The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats.  Information security management is conducted by the CIO of the Bank. Our CIO monitors, evaluates and adjusts the Bank’s Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as technology development initiatives, outsourcing arrangements, and changes to customer information systems.  Our CIO has been working in IT infrastructure for the past 25 years.  His experiences include cybersecurity and information security, IT compliance, audit reviews, policies, incident response and annual processes.  He has managed IT technology at leading brokerages, and oversees information security and cybersecurity at our Bank.  He received Certified Banking Security Manager (CBSM) certification in 2020. He also manages the third-party risk management at our Bank since 2021.  The IT Steering Committee and Management Risk Committee reviews and coordinates the status and results of information security controls, network penetration, business continuity/disaster recovery testing, and incident response plan testing. •Information Security Incident Responses.  The Bank maintains information security incident response plans for various information security/data breach scenarios. The Bank tests its incident response plans at least annually. Pursuant to applicable federal and state laws, regulations and FFIEC standards, the Bank maintains incident response notification procedures for affected customers, including notification of federal regulatory authorities and law enforcement. For the preservation of all possible avenues for law enforcement, the Bank does not disclose information security incidents to the general