Disclosure · Form 10-K · fiscal 2025
Arrow Financial Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 6, 2026· period ended December 31, 2025· AROW· CIK 717538· Updated · filing on sec.gov ↗
Arrow Financial Corp's Form 10-K for fiscal 2025, filed March 6, 2026, names the Chief Information Officer as its top security role.
What Arrow Financial's Item 1C says
Arrow Financial's Form 10-K for fiscal 2025 describes a cybersecurity risk management program in which the Board of Directors, the Chief Information Officer, the Director of IT and the ERM committee all have a role.
Board and management oversight
The Board receives quarterly reports from the ERM committee on key risk indicators, including incident response reporting and the results of ongoing vulnerability assessments and audits. The ERM Committee is chaired by the Chief Risk Officer and includes the Chief Information Officer, Director of Information Technology, and Director of Internal Audit.
How the company manages cyber risk
Arrow employs preventative and detective tools to monitor, block and provide alerts on suspicious activity, and to report on any suspected advanced persistent cybersecurity threats. Arrow regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its backup systems. Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning.
Third parties and incidents
Arrow requires specific security standards for third-party providers as part of its third-party risk management program. Arrow has not experienced a material effect on its business strategy, results of operations or financial condition from a significant compromise, significant data loss or material financial losses related to cybersecurity incidents.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to. The section does not name a specific security framework or standard.
Read from the Form 10-K filed March 6, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Officer
Reports to
not identified
Board oversight
not identified
How often the board or committee hears about it
Quarterly
“The Board receives quarterly reports from the ERM committee regarding relevant key risk indicators, which include incident response reporting, information technology and cybersecurity initiatives, and the results of ongoing vulnerability assessments and audits.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The members of our ERM committee collectively have expertise and insight into cybercrime prevention, social engineering, identity theft, and fraud prevention.”
Material incident
The filing states none
“Arrow has not experienced a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.”
The section
520 words, Form 10-K filed March 6, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 30, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
How peers in the same industry describe the seat
The SEC assigns Arrow Financial Corp standard industrial classification 6021, National commercial banks (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Community BancorpFY 2025, filed March 27, 2026 | Information Security Officer | not identified | full board |
| Chain Bridge Bancorp IncFY 2025, filed March 20, 2026 | Director of Technology | Chief Executive Officer | Risk Committee |
| ENB Financial CorpFY 2025, filed March 20, 2026 | Chief Information Security Officer | Chief Risk Officer | full board |
| Smartfinancial Inc.FY 2025, filed March 16, 2026 | Information Security Officer | Chief Risk Officer | Audit Committee |
| Ames National CorpFY 2025, filed March 12, 2026 | Chief Information Officer | not identified | full board |
| Camden National CorpFY 2025, filed March 6, 2026 | SVP, Director of Information Security | CRO | Audit Committee |
| First Commonwealth Financial CorpFY 2025, filed March 2, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
| Amerant Bancorp Inc.FY 2025, filed February 27, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Arrow Financial Corp's Form 10-K as filed with the SEC on March 6, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C . Cybersecurity
Regulatory Supervision
Arrow and its subsidiaries are subject to the provisions in the Gramm-Leach-Bliley Act relating to data security, as well as many federal and state laws, regulations and regulatory interpretations which impose standards and requirements related to cybersecurity.
Cybersecurity Risk Management & Strategy
Arrow has implemented processes designed to oversee and identify risk from cybersecurity breaches. Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its backup systems.
Arrow also regularly reviews and updates its existing internal controls and procedures and corporate governance policies and procedures intended to protect its business operations, which includes the security and privacy of the confidential information of its customers. In addition, Arrow engages a variety of vendors to meet data processing and communication needs, including evaluating our cybersecurity readiness and resilience through ongoing vulnerability assessments and audits. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis. Additionally, as part of our third-party risk management program, we require specific security standards for third-party providers.
Arrow has not experienced a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems. See Item 1A., Risk Factors , "Operational Risks" above.
Cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from cybersecurity incidents remain a priority to Arrow.
Governance
Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning. Arrow has various policies and procedures in place to mitigate cybersecurity risks and maintains a layered, defensive program to manage and maintain cybersecurity controls.
Arrow's Board of Directors, Chief Information Officer, Director of IT and the Enterprise Risk Management ("ERM") committee at the senior management level all have a role in the cybersecurity risk management program. The Board receives quarterly reports from the ERM committee regarding relevant key risk indicators, which include incident response reporting, information technology and cybersecurity initiatives, and the results of ongoing vulnerability assessments and audits.
The ERM Committee is chaired by the Chief Risk Officer and includes the Chief Information Officer, Director of Information Technology, and Director of Internal Audit. The members of our ERM committee collectively have expertise and insight into cybercrime prevention, social engineering, identity theft, and fraud prevention.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 14, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Officer
Reports to, as the filing names it
not identified
Board oversight
Full board
“The Board receives periodic reports from the ERM committee, which is chaired by the Director of Compliance and Risk and includes executive, senior, and other designated managers as appropriate.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.”
Read by claude-sonnet-5-5 on October 30, 2026; every quote verified in the stored text by code.
Item 1C . Cybersecurity
Regulatory Supervision
Arrow and its subsidiaries are subject to the provisions in the Gramm-Leach-Bliley Act relating to data security, as well as many federal and state laws, regulations and regulatory interpretations which impose standards and requirements related to cybersecurity.
In July 2023, the SEC adopted amendments intended to enhance and standardize disclosures related to cybersecurity. The amendments were effective in December 2023 and require timely disclosure of material cybersecurity incidents and annual disclosures related to cybersecurity risk management, strategy, and governance. Under the new rules, a material cybersecurity incident is required to be disclosed on a Form 8-K within four business days after the learning of a material incident. The SEC has defined a cybersecurity incident to mean "an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein." Arrow has undertaken and implemented a number of procedures and control steps to comply with these expanded cybersecurity reporting requirements as outlined below.
Cybersecurity Risk Management & Strategy
Arrow has implemented processes designed to oversee and identify risk from cybersecurity breaches. Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to
monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its backup systems.
Arrow also regularly reviews and updates its existing internal controls and procedures and corporate governance policies and procedures intended to protect its business operations, which includes the security and privacy of the confidential information of its customers. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.
Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.
Cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from cybersecurity incidents remain a priority to Arrow.
Governance
Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning. Arrow has various policies and procedures in place to mitigate cybersecurity risks and maintains a layered, defensive program to manage and maintain cybersecurity controls.
Arrow's Board of Directors, Chief Information Officer, Director of IT and the Enterprise Risk Management ("ERM") committee at the senior management level all have a role in the cybersecurity risk management program. The Board receives periodic reports from the ERM committee, which is chaired by the Director of Compliance and Risk and includes executive, senior, and other designated managers as appropriate.
Fiscal 2023 Form 10-K, filed March 11, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“Arrow's Board of Directors, Chief Information Officer, Director of IT and our enterprise risk management group all have a role in the cybersecurity risk management program.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.”
Read by claude-sonnet-5-5 on October 30, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Cybersecurity Risk Management & Strategy
Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline.
Arrow has implemented and regularly reviews and updates its internal controls and procedures as well as corporate governance policies and procedures intended to protect its business operations, including the security and privacy of the confidential information of its customers. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its back-up systems. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.
Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.
Cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from cybersecurity incidents remain a priority to Arrow.
Governance
Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning. Arrow has various policies and procedures in place to mitigate cybersecurity risks and maintains a layered, defensive program to manage and maintain cybersecurity controls.
Arrow's Board of Directors, Chief Information Officer, Director of IT and our enterprise risk management group all have a role in the cybersecurity risk management program.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.