Primis Financial Corp. 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item 1C. Cybersecurity

The Company has developed and maintains a Cyber and Information Security program that aligns with applicable regulatory guidance and industry best practices, and is intended to ensure the confidentiality, integrity, and availability of the Company's critical systems and information , including employee and customer non-public personal information, financial data, and non-public information about the Company. Cybersecurity risk is a key factor in assessing the Company's overall operational and regulatory risk and is a component of the Company's overall Enterprise Risk Management framework. The Cyber and Information Security program is designed, in part, to identify risks to sensitive information, protect that information, detect threats and events, and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents.

The Company has designed the Cyber and Information Security program based in part on the NIST Cybersecurity Framework. Use of the NIST Cybersecurity Framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST Cybersecurity Framework is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company's business.

The Cyber and Information Security program is led by the CIO and the designated Information Security Officer , who manages the day-to-day cybersecurity operations. Governance of the program is provided by the Information Technology Steering Committee and the Board of Directors' Risk Committee. The CIO periodically attends Board Risk Committee meetings and provides quarterly cybersecurity updates to this Board committee. Our CIO helps facilitate the involvement of the Board Risk Committee in oversight of potentially material cybersecurity incidents and risks and supports the information security risk oversight responsibilities of the Board and the Board Risk Committee.

The Company's IT team monitors its networks and systems to detect potential suspicious or malicious events, monitors threat intelligence sources to research evolving threats, investigates the potential impact to the Company, reviews controls to detect and defend against those threats, and proactively adjusts controls against those threats. A third-party managed security service provider supplements the IT team's efforts to provide 24 hours a day, seven days a week network monitoring coverage. The Company also performs periodic vulnerability scans and penetration testing.

Other important components of the Company's Cyber and Information Security program include maintaining a Cyber and Information Security Risk Assessment, and policies and procedures that define the program and establish standards for safe storage, handling, and secure disposal of customer and employee information. All employees receive cyber and information security training during employment orientation and at least annually thereafter.

The Company has adopted a Cyber Incident Response Plan which describes the Company's procedures for responding to cybersecurity incidents and identifies response team members. The Cyber Incident Response team is responsible for evaluating potential incidents, containing, responding to, and remediating cybersecurity incidents, and communicating significant cybersecurity incidents to Executive Management and the Board of Directors . The Company maintains sufficient business continuity planning processes to ensure recovery and resumption of its operations after a cyberattack.

The Company has deployed a formal vendor management program to create standards when evaluating third-party service providers that may have access to the Company's networks, systems, and/or customer or employee data. Third-party service providers are required to comply with the Company's policies regarding the safeguarding of non-public personal information. After contract execution, the Company's third-party service providers are monitored utilizing a risk-based evaluation process .

Our acting CIO has worked in the financial services industry for over 20 years and held similar roles at other financial institutions including five years as a Chief Technology Officer & Chief Innovation Officer at another bank.

While the Company has encountered, and will continue to encounter, cyber incidents in the normal course of business, to date, the Company has not experienced a cybersecurity incident that has, or is reasonably likely to have, materially impacted its business strategy, financial condition, or results of operation. Despite ongoing efforts to continually strengthen the Cyber and Information Security program, there is no absolute assurance that the program will be fully implemented, complied with, or effective in safeguarding the Company's networks, systems, and information. See "Item 1A. Risk Factors – Operational Risks" in this 10-K for additional information.