Disclosure · Form 10-K · fiscal 2025
ENB Financial Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 20, 2026· period ended December 31, 2025· ENBP· CIK 1437479· Updated · filing on sec.gov ↗
ENB Financial Corp's Form 10-K for fiscal 2025, filed March 20, 2026, names the Chief Information Security Officer as its top security role, reporting to the Chief Risk Officer, with oversight by the full board.
What ENB Financial's Item 1C says
ENB Financial's Form 10-K for fiscal 2025 states that the Board reviews and approves the Information Security, Vendor Management, Business Continuity, and Incident Response Programs annually. The Chief Information Security Officer oversees the company's information security programs.
Board and management oversight
The CISO provides periodic updates to the Board, including an annual report. The CISO reports regularly to management committees, including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees.
Who leads security
The CISO operates within the risk management function and reports directly to the Chief Risk Officer, who reports to the Board of Directors. The CISO has more than twenty-five years of relevant professional experience and multiple industry certifications.
How the company manages cyber risk
The Corporation maintains an Information Security Program aligned with the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), applicable regulatory guidance, and recognized industry standards. A third-party risk assessment platform, together with the NIST CSF 2.0 framework, is used annually to evaluate risk. All employees and directors receive cybersecurity awareness training upon hire and at least annually thereafter. The company performs regular penetration testing and vulnerability scanning to assess control effectiveness. The company maintains a cross-functional Incident Response Team trained to respond to cybersecurity events. The team conducts annual tabletop exercises and ensures required notifications are made in accordance with applicable laws, regulations, and internal policies.
Third parties and incidents
Third parties are assessed based on service type and associated compliance, financial, operational, and security risks. For the year ended December 31, 2025, the Corporation did not experience any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, its operations, financial condition, or results.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 20, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
Chief Risk Officer
“The CISO operates within the risk management function and reports directly to the Chief Risk Officer, who reports to the Board of Directors.”
Board oversight
Full board
“The Information Security, Vendor Management, Business Continuity, and Incident Response Programs are reviewed and approved by the Board annually.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “The Corporation maintains a comprehensive Information Security Program aligned with the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), applicable regulatory guidance, and recognized industry standards.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“With more than twenty-five years of relevant professional experience and multiple industry certifications, the CISO provides periodic updates to the Board, including a comprehensive annual report.”
Material incident
The filing states none
“For the year ended December 31, 2025, the Corporation did not experience any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, its operations, financial condition, or results.”
The section
489 words, Form 10-K filed March 20, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 4, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns ENB Financial Corp standard industrial classification 6021, National commercial banks (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Community BancorpFY 2025, filed March 27, 2026 | Information Security Officer | not identified | full board |
| Chain Bridge Bancorp IncFY 2025, filed March 20, 2026 | Director of Technology | Chief Executive Officer | Risk Committee |
| Smartfinancial Inc.FY 2025, filed March 16, 2026 | Information Security Officer | Chief Risk Officer | Audit Committee |
| Ames National CorpFY 2025, filed March 12, 2026 | Chief Information Officer | not identified | full board |
| Arrow Financial CorpFY 2025, filed March 6, 2026 | Chief Information Officer | not identified | not identified |
| Camden National CorpFY 2025, filed March 6, 2026 | SVP, Director of Information Security | CRO | Audit Committee |
| First Commonwealth Financial CorpFY 2025, filed March 2, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
| Amerant Bancorp Inc.FY 2025, filed February 27, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of ENB Financial Corp's Form 10-K as filed with the SEC on March 20, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of operations, we collect and store confidential information, including personal data relating to depositors, borrowers, employees, contractors, vendors, and suppliers. We rely extensively on the secure processing, storage, and transmission of sensitive financial, personal, and proprietary information within our computer systems and networks.
The Corporation maintains a comprehensive Information Security Program aligned with the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), applicable regulatory guidance, and recognized industry standards. Core components of this program include a risk assessment framework to identify, evaluate, and mitigate cybersecurity risks; a vendor management program addressing third-part y risk; a business continuity program designed to support operational resilience; and an incident response program establishing protocols for cybersecurity incident management and notification.
The Chief Information Security Officer (CISO) oversees these programs and reports regularly to management committees, including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees. The CISO operates within the risk management function and reports directly to the Chief Risk Officer, who reports to the Board of Directors. With more than twenty-five years of relevant professional experience and multiple industry certifications, the CISO provides periodic updates to the Board, including a comprehensive annual report. The Information Security, Vendor Management, Business Continuity, and Incident Response Programs are reviewed and approved by the Board annually.
The ISO maintains risk assessments for critical information systems, vendors, and processes. A third-party risk assessment platform, together with the NIST CSF 2.0 framework, is used annually to evaluate risk. Third parties are assessed based on service type and associated compliance, financial, operational, and security risks. The scope of due diligence and ongoing monitoring is commensurate with the level of risk identified.
All employees and directors receive cybersecurity awareness training upon hire and at least annually thereafter. In addition, simulated phishing exercises are conducted regularly to assess awareness and provide supplemental
ENB FINANCIAL CORP
training when needed. The Corporation employs data loss prevention and web filtering technologies to help prevent unauthorized data exfiltration and block malicious content. Regular penetration testing and vulnerability scanning are performed to assess control effectiveness. Our cybersecurity strategy follows a layered defense-in-depth approach that integrates people, processes, and technology to monitor, detect, and respond to suspicious activity, including potential advanced persistent threats.
Access to data and systems is granted solely on a need-to-know basis aligned with job responsibilities. The Information Security Department approves all access changes, and critical system access rights are reviewed at least annually.
The Corporation maintains a cross-functional Incident Response Team trained to respond to cybersecurity events. The team conducts annual tabletop exercises and is responsible for ensuring required notifications are made in accordance with applicable laws, regulations, and internal policies.
For the year ended December 31, 2025, the Corporation did not experience any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, its operations, financial condition, or results.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 21, 2025 sec.gov ↗
Top security role, as the filing names it
Information Security Officer
Reports to, as the filing names it
Chief Risk Officer
“The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors.”
Board oversight
Full board
“The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report.”
Person named in the filing
not identified
Experience, as stated
Stated
“The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications.”
Material incident
The filing states none
“During the year ended December 31, 2024, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.”
Read by claude-sonnet-5-5 on November 4, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Cybersecurity, data privacy, and data protection
are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as the
personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily
on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer
systems and networks.
The Corporation has developed and implemented an Information
Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards
and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment
program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a
business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident
response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their
statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees.
The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board
of Directors. The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident
response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including
a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board
annually.
The ISO maintains risk assessments for critical IT systems, vendors,
and processes. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are used annually
to assess these risks. Third parties are assessed to address their risks according to service type, compliance risk, financial risk, operational
risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on that assessment.
The ISO conducts training on cybersecurity risks for all new
employees, and at least annually for existing employees and the Board of Directors . In addition to this training program, simulated phishing
attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training
as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's
network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are
performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology.
We leverage people, processes, and technology to manage and maintain cybersecurity
controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity,
as well as to report on any suspected advanced persistent threats.
Access to data on the Corporation's networks is granted only
if needed for job functions. The Information Security Department approves all changes to access and critical systems are subject to annual
review.
An Incident Response Team that includes representatives from
key areas of the Corporation meets in the event of cybersecurity incidents. This Team receives special training, including an annual tabletop
exercise. The Team ensures the proper notifications are made to comply with all relevant laws, rules, regulations, and policies.
During the year ended December 31, 2024, there were no cybersecurity
incidents that materially affected or are reasonably likely to materially affect the Corporation.
Fiscal 2023 Form 10-K, filed March 22, 2024 sec.gov ↗
Top security role, as the filing names it
Information Security Officer
Reports to, as the filing names it
Chief Risk Officer
“The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors.”
Board oversight
Full board
“The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report.”
Person named in the filing
not identified
Experience, as stated
Stated
“The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications.”
Material incident
The filing states none
“During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.”
Read by claude-sonnet-5-5 on November 4, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Cybersecurity, data privacy, and data protection are
critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as the personal
information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the
secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer
systems and networks.
The Corporation has developed and implemented an Information
Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards
and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment
program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a
business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident
response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses
to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees. The ISO
is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors.
The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response,
and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive
annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.
The ISO maintains risk assessments for critical IT systems,
vendors, and processes. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are
used annually to assess these
ENB FINANCIAL CORP
risks. Third parties are assessed to address their risks according to service type, compliance risk, financial
risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on that assessment.
The ISO conducts training on cybersecurity risks for
all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program,
simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide
supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does
not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and
vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our
products, services, and technology. We leverage people, processes, and technology to manage and maintain cybersecurity controls. We
employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as
well as to report on any suspected advanced persistent threats.
Access to data on the Corporation's networks is granted only
if needed for job functions. The Information Security Department approves all changes to access and critical systems are subject to annual
review.
An Incident Response Team that includes representatives from
key areas of the Corporation meets in the event of cybersecurity incidents. This Team receives special training, including an annual tabletop
exercise. The Team ensures the proper notifications are made to comply with all relevant laws, rules, regulations, and policies.
During the year ended December 31, 2023, there were no cybersecurity
incidents that materially affected or are reasonably likely to materially affect the Corporation.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.