Territorial Bancorp Inc. - (TBNK)
10-K Filing Date: March 15, 2024
Cybersecurity is a significant and integrated component of Territorial Savings Bank’s risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, Territorial Savings Bank has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect Territorial Savings Bank.
To prepare and respond to incidents, Territorial Savings Bank has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Vendor Management, and Incident Response. Territorial Savings Bank engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.
The Information Security Department of Territorial Savings Bank is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Security Department is managed by the Board-appointed Information Security Officer (the “ISO”) who reports directly to Territorial Savings Bank’s Executive Vice President of Administration. The ISO has four years of experience with Territorial Savings Bank and an additional 29 years of experience in the information technology (“IT”) field. The ISO also oversees Territorial Savings Bank’s Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout Territorial Savings Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department provides on-going technology and IT threat updates to ensure the latest threats are addressed. In addition, the ISO participates in penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The ISO presents information security and cybersecurity updates at least quarterly to Territorial Savings Bank’s Information Technology Steering Committee, which consists of the Executive Vice President of Administration, the Senior Vice President of Electronic Banking, the Information Technology Manager, the Information Security Officer, information technology staff, and staff from other departments within the organization. The committee minutes are reviewed by the Board of Directors after each meeting.
30
The Information Security Department provides oversight, from a risk perspective, of IT security practices. As referenced above, the ISO provides information security updates to the Information Technology Steering Committee at each Information Technology Steering Committee meeting. Additional information security training to the Board of Directors is provided through targeted training overseen by the ISO. In addition, as discussed below, Territorial Savings Bank has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of Territorial Savings Bank. The Incident Response Plan is implemented and maintained by the ISO. Cybersecurity metrics are reported to management committees at least monthly and are summarized in annual reporting to the Board of Directors.
The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.
Risk Assessment. On a periodic basis, but not less than annually, the Information Security Officer (the “ISO”) identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, Territorial Savings Bank’s Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Board of Directors reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.
Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include:
| ● | Applying vendor-provided software fixes, commonly called patches. |
| ● | Implementing documented, approved, and tested changes to security configurations. |
| ● | Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. |
| ● | Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. |
| ● | Conducting subsequent penetration testing and vulnerability assessments, as warranted. |
| ● | Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect Territorial Savings Bank. |
Internal Controls, Audit, and Testing. Regular internal monitoring is integral to Territorial Savings Bank’s risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.
Service Providers. Like many companies, Territorial Savings Bank relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, Territorial Savings Bank maintains a risk-based Vendor Management Program designed to identify, measure, monitor, and control risks related to outsourced vendor relationships. The Vendor Management Program is implemented through a Vendor Management Program Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Territorial Savings Bank data. The Vendor Management Program Policy applies to any business arrangement between Territorial Savings Bank and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Vendor Management Program is reviewed as part of Territorial Savings Bank’s annual Internal Audit Risk Assessment.
Employees and Training. Employees are the first line of defense against cybersecurity events. Each employee is responsible for protecting Territorial Savings Bank and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to
31
their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, managed endpoint detection and response, digital risk protection services, data loss prevention scanning, user behavior analytics, multi-factor authentication, data backups, and business continuity applications. Notable services include 24/7 security monitoring and response, weekly vulnerability scanning, third-party monitoring, and threat intelligence.
Board Reporting. At least annually, the ISO reports to the Board the overall status of the Information Security Program and Territorial Savings Bank’s compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management’s responses and any recommendations for program changes.
Program Adjustments. The ISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.
Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to Territorial Savings Bank and its customers, Territorial Savings Bank maintains a structured and systematic incident response plan (the “IRP”) for all information security incidents that affect any of the IT systems, network, or data of Territorial Savings Bank, including Territorial Savings Bank’s data held, or IT services provided by third-party vendors or other service providers. The ISO is responsible for implementing and maintaining the IRP, which includes:
| ● | Identifying the incident response team (“IRT”) and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. |
| ● | Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. |
| ● | Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. |
| ● | Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. |
| ● | Reviewing the IRP at least annually, or whenever there is a material change in Territorial Savings Bank’s business practices that may reasonably affect its cyber incident response procedures. |
|