FS KKR Capital Corp - (FSK)
10-K Filing Date: February 26, 2024
Item 1C. Cybersecurity.
Cybersecurity
The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company’s business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.
Cybersecurity Program Overview
FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.
The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.
The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments’ third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.
Board Oversight of Cybersecurity Risks
The audit committee of the board of directors of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company’s Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.
Management's Role in Cybersecurity Risk Management
The Company’s management, including the Company’s CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company’s risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over ten years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.
Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.
Assessment of Cybersecurity Risk
The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company’s business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.