The Technology and Security Committee consists of the Company’s senior management, the IT Management, and business unit management. The primary function of the Technology and Security Committee is to perform Strategic Planning, discuss hardware and software replacement, new projects, current cybersecurity threats, and ongoing cybersecurity issues and threats. The IT Director provides an IT status report to the Board of Directors on a monthly basis.

The Company has adopted an Incident Response Plan (the “Plan”) to monitor, detect, mitigate and remediate cybersecurity incidents. The Plan requires that business unit management have a working knowledge of the Company’s Information Security Program and Incident Response Policies. Pursuant to the Plan, the IT Director identifies information owners for sensitive customer information and creates an incident response team. Each Department Manager, upon notification of a potential unauthorized access, manipulation of data or theft of any item identified under the Gramm-Leach-Bliley Act (the “GLBA”) Inventory and Asset Classification, is responsible for further assessing the situation in order to document the suspected or actual breach and forward the appropriate documentation to IT Management. The documentation of the suspected or actual incident includes the following: