Company: CCNE
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000736772-25-000071
Chunk: 52

Company: CNB FINANCIAL CORP/PA
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1C
Chunk 52
---
ITEM 1C.  CYBERSECURITY

Risk Management and StrategyThe Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation’s cybersecurity program is based on the Federal Financial Institutions Examination Council (“FFIEC”) framework which tailors the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into the Corporation’s Enterprise Risk Management (“ERM”) program, led by the Corporation’s Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The Corporation’s cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the “CITSO”), the VP of Information Technology, and the VP of Information Security. Risk owners regularly monitor cybersecurity risks and the evolving threat landscape and review and update the cybersecurity threat risk action plan in response to newly identified threats or risk mitigation actions. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. Management reassesses all suppliers on a regular interval.The Corporation maintains a Cybersecurity Incident Response Plan (the “CSIRP”), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation’s assets. Pursuant to the CSIRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the CITSO and the VP of Information Security primarily lead these efforts.

23

Table of Contents

The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation’s cybersecurity programs and to prepare a 3-year