FIDELITY D & D BANCORP INC

Being a financial services company, the Company encounters inherent cybersecurity risks and threats, which also affect its customers, suppliers, andthird-party service providers. Throughout operations, the Company handles and processes data for its customers, employees, partners, and suppliers, understanding that a cybersecurity incident impacting any of these entities could significantly impact its operations and performance. As part of the financial services sector, the Company is held to rigorous regulatory compliance standards. To effectively manage these risks and meet regulatory demands, the Company has implemented a comprehensive, risk-based information security program. This program is designed in alignment with regulatory requirements and the guiding principles of the Federal Financial Institutions Examination Council (FFIEC) handbook and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

Information Security Governance and Oversight

The Board of Directors assumes ultimate responsibility for overseeing the Company's information security program. The Company has established an Information Technology Steering Committee (ITSC), comprised of leaders from various departments across the organization, tasked with governing and overseeing the information security program. The ITSC underscores its commitment to treating cybersecurity as a business risk rather than solely a technical concern. The Chief Information Security Officer, reporting to the SVP, General Counsel, is entrusted with leading the cybersecurity risk assessment process. This includes identifying risks, assessing inherent likelihood and impact, evaluating existing mitigating controls, calculating residual risk scores, and recommending risk responses to both the ITSC and the Board of Directors.

Information Security Program

The Company's program aims to identify, protect, detect, respond, and recover from cyber threats, striving to prevent cybersecurity incidents to the extent feasible. Simultaneously, it enhances our resilience to minimize the impact of a cybersecurity event. The program is designed to be agile, proactive, and responsive to changes in the evolving threat landscape. It employs a layered cybersecurity approach, encompassing the following key elements:

Byimplementing these measures, the Company strives to maintain a strong cybersecurity posture, safeguarding the organization, customers, and partners from potential threats while ensuring compliance with industry standards and regulations.

Notwithstanding the Company's defensive measures and processes, the threat posed by cyber-attacks is extremely serious. The Company may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on the Company. While the Company has not, to date, detected a significant compromise, significant data loss, or any material financial loss related to cybersecurity attacks, our internal systems and those of our customers and third-party service providers are under constant threat. It is possible that the Company could experience a future significant cybersecurity event. The Company expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors."