Bluerock Homes Trust, Inc. 10-K

Item 1B. Unresolved Staff Comments None. Item 1C. Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, incoming (external) physical infrastructure with enhanced firmware, continuous employee training, internal reporting, and monitoring and detection tools. We also engage top third-party security providers for applications and infrastructure to identify, prioritize, assess, mitigate, and remediate risks. 58 Table of Contents Our information technology (“IT”) department regularly assess risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including but not limited to tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have implemented incident response and breach management processes which have four overarching and interconnected stages: (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. Such incident responses are overseen by our Leadership Committee comprised of our Chief Operating Officer, Chief Financial Officer, General Counsel and Senior Vice President of FP&A. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. As part of the above processes, we regularly engage external resources and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from key third parties such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents. Management has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company , including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors, “ We are highly dependent on information systems and therefore systems failures, cybersecurity incidents or other technology disruptions could negatively impact our business” and “Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.” above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. Governance Our Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board and through its committees. The Audit Committee meets annually to review enterprise security, technology risks and cybersecurity threats, risk assessments and areas of emerging risks, incidents and mitigation strategies, and industry trends. Our IT department maintains internal and external resources and is led by our Vice President of IT and assisted by our Risk Assessment/IT Compliance & Enterprise Manager . These two individuals have a combined 45+ years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. The IT department is responsible for the information security of the organization and for the oversight of all cybersecurity infrastructure and programs. The department provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings. Our Leadership Committee is responsible for the oversight of risks from cybersecurity threats. The Leadership Committee receive updates on a quarterly basis from leaders of our IT department and compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives. Our Leadership Committee and IT department discuss cybersecurity-related current events and any updates to our cybersecurity risk management and strategy programs. Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters. 59 Table of Contents Item 2. Investments As of December 31, 2025, we held nineteen consolidated investments and five preferred equity investments. The following tables provide summary information regarding our consolidated investments and preferred equity investments. Consolidated Investments ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Occupancy – ​ ​ ​ ​ ​ Number of ​ Average Year ​ Ownership ​ Average ​ Occupancy – ​ Excluding Held for ​ Operating Investment Name ​ ​ ​ Market / Location ​ ​ ​ Units (1) ​ ​ ​ Built ​ ​ ​ Interest ​ ​ ​ Rent (2) ​ ​ ​ All Units (3) ​ ​ ​ ​ Sale/Reno Units (4) ​ ​ ​ ​ Residential Communities ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Allure at Southpark ​ Charlotte, NC ​ 350 ​ 2014 ​ 98 % $ 1,681 ​ 95.7 % 96.0 % Amira at Westly ​ Tampa, FL ​ 408 ​ 1999/2023 ​ (5) ​ ​ ​ 1,847 ​ 93.1 % 93.4 % Avenue at Timberlin Park ​ Jacksonville, FL ​ 200 ​ 2001 ​ 100 % ​ 1,591 ​ 94.5 % 95.0 % District at Parkview (6) ​ Stone Mountain, GA ​ 264 ​ 2023 ​ 69 % ​ 1,907 ​ 88.3 % 88.6 % Skytop Apartments (6) ​ Cincinnati, OH ​ 361 ​ 2024 ​ 3 % ​ 1,721 ​ 94.5 % 95.0 % Southern Pines Reserve (6) ​ Aberdeen, NC ​ 272 ​ 2000/2003 ​ 22 % ​ 1,486 ​ 93.4 % 93.7 % Villas at Huffmeister ​ Houston, TX ​ 294 ​ 2007 ​ 95 % ​ 1,601 ​ 96.3 % 96.6 % Wayford at Concord ​ Concord, NC ​ 150 ​ 2019 ​ 83 % ​ 2,157 ​ 98.0 % 98.7 % Yauger Park Villas ​ Olympia, WA ​ 80 ​ 2010 ​ 95 % ​ 2,476 ​ 97.5 % 97.5 % Total Residential Communities Units / Average ​ ​ ​ 2,379 ​ ​ ​ ​ ​ $ 1,746 ​ 93.7 % 94.5 % ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Scattered Single-Family Homes ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Ballast AZ / CO / WA 84 1998 95 % $ 2,130 77.4 % 77.4 % Golden Pacific IN / KS / MO 161 1977 97 % 1,802 73.9 % 79.9 % ILE ​ TX / SE US ​ 450 ​ 1991 ​ 95 % ​ 1,862 ​ 92.9 % 93.9 % Indy-Springfield IN / MO 304 1999 100 % 1,426 91.8 % 95.5 % Peak JV 2 Various / TX 549 1982 100 % 1,382 88.3 % 90.0 % Peak JV 3 Dallas-Fort Worth, TX 42 1960 100 % 1,082 14.3 % — ​ Savannah-84 Savannah, GA 84 2022 100 % 1,875 97.6 % 97.6 % Total Scattered Single-Family Homes / Average ​ 1,674 ​ ​ ​ $ 1,625 86.9 % 90.8 % Total Operating Units / Average ​ ​ ​ 4,053 ​ ​ ​ ​ ​ $ 1,695 ​ 90.9 % 93.0 % ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Development / Lease-up Investment Name ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Residential Communities ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Abode Wendell Falls (7) ​ Wendell, NC ​ 170 ​ — ​ 100 % ​ — ​ — ​ — ​ Harmony at Clear Creek (7) ​ Shawnee, KS ​ 188 ​ — ​ 85 % ​ — ​ — ​ — ​ Parkside at Summers Corner (8) ​ Summerville, SC ​ 12 ​ 2025 ​ 100 % ​ — ​ — ​ — ​ Total Development Units ​ ​ 370 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Total Units ​ ​ ​ 4,423 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ (1) Total operating units includes an aggregate of 107 units classified as held for sale, with such units included in the following portfolios: 12 units of Golden Pacific, 27 units of ILE, 18 units of Indy-Springfield, 8 units of Peak JV 2, and all 42 units of Peak JV 3. (2) Represents the average of the ending average effective rent per occupied unit as of the last day of each month in the three months ended December 31, 2025. (3) Percent occupied is calculated as (i) the number of units occupied as of December 31, 2025 divided by (ii) total number of units, expressed as a percentage. (4) Percent occupied is calculated as (i) the number of units occupied as of December 31, 2025 divided by (ii) total number of units, expressed as a percentage, and excludes 107 units classified as held for sale and an aggregate of 11 down/renovation units. 60 Table of Contents (5) Amira at Westly is held through our DST Program (refer to Note 9 of our consolidated financial statements for further information). The Amira at Westly DST has been fully subscribed with equity from individual investors. (6) District at Parkview, Skytop Apartments and Southern Pines Reserve are held through our DST Program. (7) Represents a development project with no units delivered as of December 31, 2025. Abode Wendell Falls commenced construction in 2024 and Harmony at Clear Creek is anticipated to commence construction in 2026. (8) Parkside at Summers Corner represents a development project with units to be acquired in tranches as construction is completed. Of the total 100 units that we have committed to acquire, 12 units had been acquired as of December 31, 2025. Preferred Equity Investments ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Total Actual/ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Actual/ ​ Estimated ​ ​ ​ ​ Actual/ ​ Actual/ ​ Actual/ ​ ​ ​ ​ ​ ​ ​ ​ ​ Planned ​ Construction ​ ​ ​ ​ Estimated ​ Estimated ​ Estimated ​ ​ ​ Estimated ​ ​ ​ ​ Number ​ Cost ​ Cost to Date ​ Construction ​ Initial ​ Construction ​ ​ ​ Average Development Investment Name (1) ​ ​ ​ Location ​ ​ ​ of Units ​ ​ ​ (in millions) ​ ​ ​ ​(in millions) ​ ​ ​ Cost Per Unit ​ ​ ​ Occupancy ​ ​ ​ Completion ​ ​ ​ % Occupied ​ ​ ​ Rent (2) River Ford Brunswick, GA 170 $ 51.6 ​ $ 18.0 ​ $ 303,529 1Q 2026 1Q 2027 ​ — ​ $ 2,004 Sanford Marketplace ​ Sanford, NC ​ 300 ​ ​ 59.6 ​ ​ 12.7 ​ ​ 198,667 ​ 4Q 2026 ​ 2Q 2027 ​ — ​ ​ 1,587 Canvas at Wildwood ​ Wildwood, FL ​ 224 ​ ​ 60.3 ​ ​ 17.0 ​ ​ 269,196 ​ 4Q 2026 ​ 4Q 2027 ​ — ​ ​ 1,937 Archer at RiverBlue (3) ​ Asheville, NC ​ 245 ​ ​ 71.8 ​ ​ 10.8 ​ ​ 293,061 ​ 1Q 2028 ​ 2Q 2028 ​ — ​ ​ 2,113 Total Development Units ​ ​ ​ 939 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Operating Investment Name (4) ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Wayford at Innovation Park Charlotte, NC 210 ​ ​ ​ ​ ​ ​ ​ ​ ​ 91.4 % 2,313 Total Operating Units ​ ​ ​ 210 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Total Units/Average ​ ​ ​ 1,149 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ $ 1,934 (1) None of the development investments had commenced lease-up as of December 31, 2025. (2) For development investments, represents the average pro forma effective monthly rent per occupied unit for all expected occupied units during the first full quarter of stabilization. For the operating investment, represents the average effective monthly rent per occupied unit. (3) In December 2025, we entered into a joint venture agreement and made a commitment to invest capital for preferred equity interests in Archer at RiverBlue. No capital had been funded as of December 31, 2025. (4) Operating investment represents a stabilized operating property. ​ Item 3. Legal Proceedings We are not party to, and none of our properties are subject to, any material pending legal proceeding. Item 4. Mining Safety Disclosures Not applicable. ​ 61 Table of Contents PART II