Global Net Lease, Inc. - (GNL)
10-K Filing Date: February 27, 2024
Item 1C. Cybersecurity.
30
Cybersecurity Risk Management and Strategy
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on industry practices and accepted frameworks (e.g. the NIST framework).
Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Our cybersecurity risk management program includes:
•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
•our IT team, in coordination with senior management, is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches;
•cybersecurity awareness training of our employees, incident response personnel, and senior management;
•a risk management process for third parties, including, but not limited to service providers, suppliers, and vendors.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity Governance
Our Board considers cybersecurity risk and other information technology risks as part of its risk oversight function. Our Audit Committee reviews policies with respect to major risk assessment and risk management and reviews with management the steps taken to monitor and control such exposures. As part of this function, our Audit Committee oversees management’s implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.
The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary and appropriate, regarding cybersecurity incidents that we may experience.
The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee receives briefings from management on our cyber risk management program and receive presentations on cybersecurity topics from management, our internal auditors IT personnel or external experts as part of the Board’s continuing education on topics that impact public companies.
Our management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.
Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.
31