Company: CMTV
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001654954-25-003447
Chunk: 100

Company: COMMUNITY BANCORP /VT
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1A
Chunk 100
---
-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage. ·Reputation Risk: A significant cybersecurity incident could damage the Company’s reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities. ·Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies. ·Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage.

We have implemented a comprehensive Information Security Program to mitigate these risks, which includes:  ·Regular risk assessments and vulnerability testing of systems and networks. ·Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols. ·Employee training and awareness programs to enhance cybersecurity awareness and promote best practices. ·Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.

The Information Security Program is led by the Company’s Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant.  Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management’s responses; gaps; and recommendations for changes to the program. 

However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.

In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.

Item 2.  Properties

Although the Company does not itself own or lease real property, the Bank owns and leases various properties for its banking operations.   All of the Bank’s offices are located in Vermont, other than its loan production office in Grafton County, New Hampshire. 

 20Table of Contents

The Company's administrative offices are