Management’s Response and Corrective Action Plan: Management agrees, and has addressed this as follows: Responsible person: Lee Pliscou MLSC Board of Directors approved a revised accounting manual in October 2025 which requires an annual cybersecurity assessment and response in compliance with LSC F...
Management’s Response and Corrective Action Plan: Management agrees, and has addressed this as follows: Responsible person: Lee Pliscou MLSC Board of Directors approved a revised accounting manual in October 2025 which requires an annual cybersecurity assessment and response in compliance with LSC Financial Guide § 2.5.3, together with a formal risk assessment of banking operations to identify and address vulnerabilities, as required by LSC Financial Guide § 3.2.1. Specifically, our cybersecurity policies include the following requirements: ● Perform (and document) an annual risk assessment ● Resolve any risk findings or conclusions ● Maintain physical access controls for servers and storage rooms ● Develop and periodically test an emergency disaster prevention and recovery plan ● Perform regular back up of electronic records and systems stored offsite or in a virtual environment with easy-to-use restoration options ● Formally assign computer and data security responsibilities The risk assessment process: ● Identifies the physical and digital assets susceptible to cyberattacks ● Identifies risks to those assets (risks should be evaluated annually for changes) ● Evaluates the risks (e.g., high, medium, or low) based on likelihood and impact ● Documents the results of the risk assessment, including the development and implementation of appropriate controls Finding 2024-008 LSC Financial Guide § 2.5.3 Electronic Data Processing and Cybersecurity, continued Also, per our new Accounting Manual, MLSC conducts a risk assessment of its electronic banking policies and procedures to identify areas that need additional safeguards and protections. We do this in conjunction with the annual cybersecurity risk assessment. As of November 2025, MLSC has contracted with a consultant to provide such an assessment, and the contractor has delivered a first draft of an assessment. Anticipated completion date: MLSC has already completed the requirement to have policies in compliance with LSC Financial Guide Sections 2.5.3 (Electronic Data Processing and Cybersecurity) and 3.2.1 (Bank accounts). MLSC will complete the annual assessment by February 28, 2026.