Cybersecurity Risk Management and Strategy
Assessing, identifying and managing material risks from cybersecurity threats is critical for maintaining the security of the Company’s data and information systems, andis integrated into our enterprise risk management systems and processes. The Bank’s approach to cybersecurity risk management and strategy is based on the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool (“CAT”), which provides a repeatable and measurable process for evaluating cybersecurity preparedness and assessing, identifying, and managing material risks from cybersecurity threats. The CAT incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.
The CAT consists of two parts: Cybersecurity Inherent Risk Profile and Cybersecurity Maturity. Completion of both parts of the CAT allow management and the Board to evaluate whether the Company’s cybersecurity risk and preparedness are aligned. The Cybersecurity Inherent Risk Profile is the level of risk posed to the Company by technologies and connection types, delivery channels, online/mobile products and technology services, organizational characteristics and external threats. Cybersecurity Maturity is designed to help management measure the Company’s level of risk and corresponding controls under the following five domains: (i) Cyber Risk Management and Oversight; (ii) Threat Intelligence and Collaboration; (iii) Cybersecurity Controls; (iv) External Dependency Management; and (v) Cyber Incident Management and Resilience.
The Information Security Officer (“ISO”) and the Company’s Information Technology Committee conduct and review the CAT annually to identify changes to the Company’s inherent risk profile; when new threats arise or when considering changes to the business strategy, such as expanding operations, offering new products and services, or entering into new third-party relationships that support critical activities. Consequently, management can determine whether additional risk management practices or controls are needed to maintain or augment the Company’s cybersecurity maturity.
In an effort to continually share threat intelligence and increase awareness of cybersecurity trends, the Company has also implemented a Cybersecurity Education and Awareness Program. This program includes the following components:
| ● | Mandatory annual cybersecurity employee training for all employees; |
| ● | Training specifically targeted to Senior Management and Information Technology staff; |
| ● | Bimonthly review of emerging security trends by the Information Technology Committee; |
| ● | Mandatory annual cybersecurity Board training; |
| ● | Periodic communication to employees highlighting internal control requirements and information about common threats or fraud schemes; and |
| ● | Periodic communication to the Bank’s customers highlighting emerging threats and good cybersecurity hygiene. |
To date, we have not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A. Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.
Board and Management Governance
The Company’s Board of Directors recognizes the importance of maintaining the trust and confidence of our customers, employees, and shareholders, including the risks associated with cybersecurity threats. The Board of Directors’ responsibilities for cybersecurity risk management and strategy include the following:
| ● | Engaging management in establishing the Bank’s vision, risk appetite, and overall strategic direction; |
| ● | Approving plans to ensure the use of the CAT; |
| ● | Reviewing management’s analysis of the CAT results, inclusive of any reviews or opinions on the results issued by independent risk management or internal audit functions regarding those results; |
| ● | Reviewing management’s determination of whether the Bank’s cybersecurity preparedness is aligned with its risks; |
| ● | Reviewing and approving plans to address any risk management or control weaknesses; and |
| ● | Reviewing the results of management’s ongoing monitoring of the Bank’s exposure to and preparedness for cyber threats. |
The Company has also appointed an ISO, who reports directly to the Audit Committee and to the Chief Executive Officer andshares a co-sourced relationship with a third party consultant. The ISO has been with Bank First for over 10 years in various operational and administrative roles. For the past five years, he has served as the Bank’s Enterprise Risk Manager, and as ISO for the past three years. In 2022, he earned the Certified Banking Security Manager certification from SBS Cybersecurity. The ISO works closely with the Director of Technology to ensure that the Bank’s cybersecurity controls are in line with established internal culture, Board expectations and risk appetite, and all regulatory requirements. The ISO’s responsibilities include the following:
| ● | Developing a plan to conduct and complete the CAT on an annual basis; |
| ● | Working with the VP-Director of Technology to evaluate the results of the CAT; |
| ● | Leading employee efforts during the CAT to facilitate timely responses from across the Bank; |
| ● | Setting the target state of cybersecurity preparedness that best aligns to the Board of Directors’ approved risk appetite; |
| ● | Reviewing, approving, and supporting plans to address risk management and control weaknesses; |
| ● | Analyzing and presenting the results of the CAT to the full Board of Directors; |
| ● | Providing periodic cybersecurity updates to the full Board of Directors; |
| ● | Overseeing the performance of ongoing monitoring to remain nimble and agile in addressing evolving areas of cybersecurity risk; and |
| ● | Overseeing the Bank’s cybersecurity preparedness. |
| ● | Finally, the Company has established an Information Technology Committee to support the ISO in implementing the CAT, document formal action plans to be presented to the Board of Directors, enforce and implement the controls established by the CAT, and ensure employee compliance with internal controls |
