A Word from Orrstown Bank’s Chief Information Security Officer:

Protecting client information and privacy is of paramount importance for Orrstown Bank. That's why we’ve hired seasoned information security and privacy professionals to implement multiple layers of logical and physical controls. The following letter provides an overview of these financial security measures.

Knowing Where Sensitive Information Resides

To protect sensitive information, you need to know what information exists, where it's stored, and how it moves between business applications and/or users. Orrstown Bank maintains accurate inventory of information stored in business applications and unstructured data stores. Each of these locations is risk classified using several attributes, including the volume and confidentiality of the information. The risk classification focuses our security investments on the highest risk areas.

Giving the Right Access at the Right Time to the Right People

Limiting access to information remains one of the primary control mechanisms to protect information. Orrstown Bank strives to give the right access to the right people at the right time. To that end, we've made investments in solutions designed to provide strong authentication mechanisms to both internal and external users and ensure that any access is authorized.

Protecting Against External Threats

Security is most effective when implemented in layers. Although no single implementation or practice is impenetrable, many are layered together to create a strong weave of protection. Orrstown Bank employs the latest in threat intelligence automation, firewalls, intrusion prevention, and anti-malware technologies to protect the bank against external threats. We have several security measures in place to ensure your online safety. All information entered and displayed on the Orrstown Bank Online Banking site is protected by strong encryption through Transport Layer Security (TLS). You will establish a unique login ID and password and enter it each time you log in. Orrstown Bank recommends you create a complex password containing a mix of numbers and characters. The system will prompt you for your personal challenge and response questions if it sees pattern changes of online use, such as a new internet service provider or bill payment payee.

Protecting Against Insider Threats

Orrstown Bank recognizes that insiders can do as much damage to the safety and privacy of client information as external threats, whether accidental or malicious. To help protect against the malicious insider, Orrstown Bank employs the principle of least privilege, which grants only what is absolutely necessary to accomplish a job role to the user. Additionally, Orrstown Bank invests in controls designed to ensure that sensitive information is not accidentally or purposely lost or stolen by insiders. Finally, because Orrstown Bank knows that based on the nature of the roles at the bank, these controls will not prevent every incident. For an additional level of security, we implement multiple layers of detective controls in the form of behavior monitoring, reconciliation processes, etc.

Managing Vendors

Like many organizations, Orrstown Bank relies on vendors to provide certain services. We have a robust vendor management program designed to ensure that our vendors treat our client information as securely as we would.

Educating Employees and Clients

Finally, Orrstown Bank understands that humans are always going to be the weakest link. As such, we continue to promote awareness about the responsibility of every employee to both protect information and provide education on how best to safeguard sensitive information, along with notices about current threats (including phishing schemes and scams), etc. Orrstown Bank also publishes a quarterly newsletter with information on how clients can help to protect their own information.

Respectfully submitted,

Andrew Linn

Senior Vice President, Chief Information Security Officer

Orrstown Bank