UNITED BANCORP INC /OH/

None.

General

All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Our cybersecurity risk management program is integrated into our overall enterprise risk management framework, ensuring that cybersecurity risks are evaluated alongside other operational, financial, and strategic risks facing the Company.

Legal Overview

Pursuant to the requirements of section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p–1) and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801, 6805(b)), the federal bank regulatory agencies adopted the Interagency Guidelines Establishing Information Security Standards (the “Guidelines”). The requirements of the Guidelines apply to all FDIC-insured depository institutions, most subsidiaries of such entities, and to state savings associations. Federal law also mandates that information security procedures and controls be routinely evaluated by the Bank’s state and federal regulators as part of the standard safety and soundness examination process.

Bank Security Policy

To comply with all applicable federal requirements, the Bank’s Board of Directors has adopted the Unified Bank Information Security Policy (the “ISP”), which establishes a program that the Bank’s management and board can use to:

Under the ISP, the Board of Directors or an appropriate committee thereof is required to oversee all efforts with respect to the development, implementation and maintenance of an effective information security program. In addition, the ISP charges management with responsibility for identifying all reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration or destruction of Bank information, and directs management to develop and implement procedures and other controls designed to reduce or eliminate identified risks.

The Bank has also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of the Bank’s critical third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and based on risk profile. A variety of inputs are used in such assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

In addition to being subject to routine examination by the Bank’s state and federal regulators, the efficacy of the Bank’s information security program is also audited annually by anindependent third-party auditing firm.

Incident Response

The Bank has established an incident response plan designed to facilitate the prompt detection, assessment, containment, and remediation of cybersecurity incidents. Upon detection of a potential incident, the Bank’s information security personnel assess the nature and scope of the threat and, where appropriate, engage third-party forensic specialists to assist in the investigation. The incident response plan includes escalation procedures to ensure that significant incidents are promptly reported to senior management and the Board of Directors, as well as to regulators and affected customers when required by applicable law. Following the resolution of any incident, the Bank conducts a post-incident review to identify lessons learned and implement any necessary enhancements to its cybersecurity controls.

Managerial and Board Oversight

To facilitate oversight, the Bank has established a front line committee, the Compliance Risk Assessment Committee, which is comprised ofall members of senior management, the head of information security and certain other operationally significant employees. This Committee, which meets quarterly, is responsible for monitoring all key operational risks applicable to the Bank. Cyber risk assessments are routinely conducted andreported to the Audit Committee of the Board of Directors In addition, key members of senior management also meet annually with a cyber risk consultant who apprises management on emerging cyber threats and evaluates the Company’s adequacy of cyber risk insurance coverage. The findings of this meeting are also reported to the Executive Committee. All significant matters are reported by the Executive Committee to the full Board of Directors.

Cybersecurity Risks and Material Impact

As of the date of this Annual Report, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, and there can be no assurance that our security measures will be sufficient to prevent all potential incidents. A successful cyberattack or other security breach could result in unauthorized access to customer data, disruption of our operations, regulatory penalties, litigation, and reputational harm.