Disclosure · Form 10-K · fiscal 2025
Community Bancorp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 27, 2026· period ended December 31, 2025· CMTV· CIK 718413· Updated · filing on sec.gov ↗
Community Bancorp's Form 10-K for fiscal 2025, filed March 27, 2026, names the Information Security Officer as its top security role, with oversight by the full board.
What Community Bancorp's Item 1C says
Community Bancorp's Form 10-K for fiscal 2025 describes a board that receives annual reports on the Information Security Program from the Information Security Officer. The Information Security Program is led by the Company's Information Security Officer.
Board and management oversight
The Information Security Officer reports status and compliance with the program to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters including the risk assessment, service provider arrangements, results of monitoring and testing, and security breaches and management's responses.
Who leads security
The Information Security Officer works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank.
How the company manages cyber risk
The company conducts regular risk assessments and vulnerability testing of systems and networks. Risk assessments are updated at least annually or more frequently if circumstances warrant. The company deploys cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols. The company provides employee training and awareness programs to enhance cybersecurity awareness and promote best practices. The company has incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.
Third parties and incidents
The company relies on third-party service providers and vendors, which exposes it to cybersecurity risks associated with systems and processes. The company states that cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees.
What the section does not state
The section does not name the person who holds the top security role. The section does not mention outside assessors, consultants or auditors.
Read from the Form 10-K filed March 27, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Information Security Officer
Reports to
not identified
Board oversight
Full board
“Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant.”
How often the board or committee hears about it
Annually
“Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
not identified
The section
504 words, Form 10-K filed March 27, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 3, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Community Bancorp standard industrial classification 6021, National commercial banks (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Chain Bridge Bancorp IncFY 2025, filed March 20, 2026 | Director of Technology | Chief Executive Officer | Risk Committee |
| ENB Financial CorpFY 2025, filed March 20, 2026 | Chief Information Security Officer | Chief Risk Officer | full board |
| Smartfinancial Inc.FY 2025, filed March 16, 2026 | Information Security Officer | Chief Risk Officer | Audit Committee |
| Ames National CorpFY 2025, filed March 12, 2026 | Chief Information Officer | not identified | full board |
| Arrow Financial CorpFY 2025, filed March 6, 2026 | Chief Information Officer | not identified | not identified |
| Camden National CorpFY 2025, filed March 6, 2026 | SVP, Director of Information Security | CRO | Audit Committee |
| First Commonwealth Financial CorpFY 2025, filed March 2, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
| Amerant Bancorp Inc.FY 2025, filed February 27, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Community Bancorp's Form 10-K as filed with the SEC on March 27, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity Risk
The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to:
·
Cyber-attacks: We are vulnerable to cyber-attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.
·
Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property.
·
Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation.
·
Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage.
·
Reputation Risk: A significant cybersecurity incident could damage the Company's reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities.
·
Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies.
·
Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage.
We have implemented a comprehensive Information Security Program to mitigate these risks, which includes:
·
Regular risk assessments and vulnerability testing of systems and networks.
·
Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols.
·
Employee training and awareness programs to enhance cybersecurity awareness and promote best practices.
·
Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.
The Information Security Program is led by the Company's Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant. Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management's responses; gaps; and recommendations for changes to the program.
However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.
In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 28, 2025 sec.gov ↗
Top security role, as the filing names it
Information Security Officer
Reports to, as the filing names it
Information Technology Steering Committee and the Board
“Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant.”
Board oversight
Full board
“Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
not identified
Read by claude-sonnet-5-5 on November 3, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity Risk
The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to:
·
Cyber-attacks: We are vulnerable to cyber-attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.
·
Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property.
·
Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation.
·
Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage.
·
Reputation Risk: A significant cybersecurity incident could damage the Company's reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities.
·
Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies.
·
Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage.
We have implemented a comprehensive Information Security Program to mitigate these risks, which includes:
·
Regular risk assessments and vulnerability testing of systems and networks.
·
Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols.
·
Employee training and awareness programs to enhance cybersecurity awareness and promote best practices.
·
Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.
The Information Security Program is led by the Company's Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant. Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management's responses; gaps; and recommendations for changes to the program.
However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.
In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.
Fiscal 2023 Form 10-K, filed March 29, 2024 sec.gov ↗
Top security role, as the filing names it
Information Security Officer
Reports to, as the filing names it
Information Technology Steering Committee and the Board
“Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant.”
Board oversight
Full board
“Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
not identified
Read by claude-sonnet-5-5 on November 3, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity Risk
The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to
:
·
Cyber attacks: We are vulnerable to cyber attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.
·
Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property.
·
Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation.
·
Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage.
·
Reputation Risk: A significant cybersecurity incident could damage the Company's reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities.
·
Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies.
·
Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage.
We have implemented a comprehensive Information Security Program to mitigate these risks, which includes:
·
Regular risk assessments and vulnerability testing of systems and networks.
·
Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols.
·
Employee training and awareness programs to enhance cybersecurity awareness and promote best practices.
·
Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.
The Information Security Program is led by the Company's Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant. Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management's responses; gaps; and recommendations for changes to the program.
However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.
In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.