Disclosure · Form 10-K · fiscal 2025
Broadway Financial Corp \DE\ 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 31, 2026· period ended December 31, 2025· BYFC· CIK 1001171· Updated · filing on sec.gov ↗
Broadway Financial Corp \DE\'s Form 10-K for fiscal 2025, filed March 31, 2026, names the Director of Information Technology as its top security role, reporting to the Chief Financial Officer, with oversight by the Risk and Compliance Committee.
What Broadway Financial Corp \DE\'s Item 1C says
Broadway Financial's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Risk and Compliance Committee, a board-level committee designated by the Board. In management, the Director of Information Technology, together with the Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks.
Board and management oversight
The Board, as a whole and at the committee level, has oversight for the most significant risks and for the processes to identify, assess and mitigate cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and the company's processes require ad hoc updates within two days of a breach. The full Board receives an Annual Report from the Director of Information Technology on the Company's Information Technology Systems, including cybersecurity risk.
Who leads security
The Director of Information Technology reports to the Chief Financial Officer and has over 15 years of experience managing information technology and cybersecurity matters. These cybersecurity processes are managed and monitored by an information technology team that is led by the Director of Information Technology.
How the company manages cyber risk
The company has implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through its information technology systems. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. The company conducts penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments. The company conducts regular employee training on cybersecurity and information security, among other topics. The company considers cybersecurity, along with other significant risks, within its overall enterprise risk management framework.
Third parties and incidents
The company consults with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks. The company's risk assessments include due diligence on its key technology vendors, contractors, and suppliers. Since the beginning of the last fiscal year, the company has not identified risks from known cybersecurity threats that have materially affected it.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 31, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Director of Information Technology
Reports to
Chief Financial Officer
“Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity , and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks.”
Board oversight
Risk and Compliance Committee
“The Risk and Compliance Committee is a board-level committee designated by our Board to oversee cybersecurity risks.”
How often the board or committee hears about it
At least quarterly
“The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Company's”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework,”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity , and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks.”
Material incident
The filing states none
“Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us.”
The section
699 words, Form 10-K filed March 31, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 6, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
How peers in the same industry describe the seat
The SEC assigns Broadway Financial Corp \DE\ standard industrial classification 6035, Savings institution, federally chartered (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Finance).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Kentucky First Federal BancorpFY 2026, filed September 28, 2026 | Information Security Officer | CEO | Audit Committee |
| BankUnited, Inc.FY 2025, filed February 26, 2026 | CISO | CRO | Risk Committee of the Board of Directors |
| Magyar Bancorp, Inc.FY 2025, filed December 19, 2025 | Information Security Officer | not identified | full board |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| QDM International Inc.FY 2026, filed June 29, 2026 | responsible offer | Chief Executive Officer | not identified |
| Roadzen Inc.FY 2026, filed June 29, 2026 | not identified | not identified | corporate governance committee |
| StepStone Group Inc.FY 2026, filed May 27, 2026 | Partner, Chief Information Security Officer & Head of Information Technology | President and Co-Chief Operating Officer | audit committee |
| Hamilton Lane IncFY 2026, filed May 21, 2026 | head of end user technology and information security | not identified | audit committee |
| Triller Group Inc.FY 2025, filed April 14, 2026 | Group Chief Information Officer | not identified | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Broadway Financial Corp \DE\'s Form 10-K as filed with the SEC on March 31, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C.
CYBERSECURITY
In the ordinary course
of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in‑depth, layered, defensive approach that leverages people, processes, and technology to manage and
maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of
our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant
compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third‑party service providers are under constant threat, creating the possibility of future events. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats,
as well as due to the expanding use of internet banking, mobile banking and other technology‑based products and services by us and our customers.
The security and
maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality,
integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework,
and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data
loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers .
We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks , including anticipated future threats and trends, and their estimated impact on the Company's risk
environment.
Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity ,
and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we
face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us.
Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of
third-party service providers could have a material adverse effect on us."
The Board, as a whole and at the committee level, has oversight
for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level
committee designated by our Board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Company's
cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board receives an Annual Report from the Director of Information Technology on the Company's Information Technology
Systems, including cybersecurity risk.
Earlier filings on record
Fiscal 2024 Form 10-K/A, filed December 23, 2025 sec.gov ↗
Top security role, as the filing names it
Director of Information Technology
Reports to, as the filing names it
Chief Financial Officer
“Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity ,”
Board oversight
Risk and Compliance Committee
“The Risk and Compliance Committee is a board-level committee designated by our Board to oversee cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity ,”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us.”
Read by claude-sonnet-5-5 on November 6, 2026; every quote verified in the stored text by code.
ITEM 1C.
CYBERSECURITY
In the ordinary course
of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in‑depth, layered, defensive approach that leverages people, processes, and technology to manage and
maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of
our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant
compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third‑party service providers are under constant threat, creating the possibility of future events. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats,
as well as due to the expanding use of internet banking, mobile banking and other technology‑based products and services by us and our customers.
The security and
maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality,
integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework,
and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data
loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers .
We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks , including anticipated future threats and trends, and their estimated impact on the Company's risk
environment.
Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity ,
and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we
face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity
risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have
a material adverse effect on us."
The Board, as a whole and at the committee level, has oversight
for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level
committee designated by our Board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's
cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board receives an Annual Report from the Director of Information Technology on the Bank's Information Technology
Systems, including cybersecurity risk.
Fiscal 2023 Form 10-K, filed May 20, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Operating Officer
“Our Chief Information Security Officer, who reports to the Chief Operating Officer, has over 27 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks.”
Board oversight
Risk and Compliance Committee
“The Risk and Compliance Committee is a board-level committee designated by our board to oversee cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Chief Information Security Officer, who reports to the Chief Operating Officer, has over 27 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us.”
Read by claude-sonnet-5-5 on November 6, 2026; every quote verified in the stored text by code.
ITEM 1C.
CYBERSECURITY
In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in‑depth, layered,
defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as
well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to
changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third‑party
service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the
rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology‑based products and services by us and our customers.
The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess,
identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing
therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Information Security Officer, and includes mechanisms, controls, technologies, systems, and other processes designed to
prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data
recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers. We conduct regular employee training on cybersecurity and information security, among other
topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their
estimated impact on the Company's risk environment.
Our
Chief Information Security Officer, who reports to the Chief Operating Officer, has over 27 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business
operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face,
within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, and we face ongoing
cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures,
interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."
The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and
mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least
quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board
of Directors receives an Annual Report from the Chief Information Security Officer on the Bank's Information Technology Systems, including cybersecurity risk.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.