Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Risk Management and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.
Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, incoming (external) physical infrastructure with enhanced firmware, continuous employee training, internal reporting, and monitoring and detection tools. We also engage top third-party security providers for applications and infrastructure to identify, prioritize, assess, mitigate, and remediate risks.
56
Table of Contents
Our information technology (“IT”) department regularly assess risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including but not limited to tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.
We have implemented incident response and breach management processes which have four overarching and interconnected stages: (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. Such incident responses are overseen by our Leadership Committee comprised of our Chief Operating Officer, Chief Financial Officer, General Counsel and Senior Vice President of FP&A.
Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.
As part of the above processes, we regularly engage external resources and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.
Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from key third parties such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.
Management has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors, “ We are highly dependent on information systems and therefore systems failures, cybersecurity incidents or other technology disruptions could negatively impact our business” and “Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.” above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers.
Governance
Our Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board and through its committees. The Audit Committee meets annually to review enterprise security, technology risks and cybersecurity threats, risk assessments and areas of emerging risks, incidents and mitigation strategies, and industry trends.
Our IT department maintains internal and external resources and is led by our IT Manager and assisted by our Risk Assessment/IT Compliance & Enterprise Manager. These two individuals have a combined 40+ years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. The IT department is responsible for the information security of the organization and for the oversight of all cybersecurity infrastructure and programs. The department provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.
Our Leadership Committee is responsible for the oversight of risks from cybersecurity threats. The Leadership Committee receive updates on a quarterly basis from leaders of our IT department and compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives. Our Leadership Committee and IT department discuss cybersecurity-related current events and any updates to our cybersecurity risk management and strategy programs.
Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.
57
Table of Contents
Item 2. Investments
As of December 31, 2023, we held eighteen real estate investments, consisting of eleven consolidated investments and seven held through preferred equity and loan investments. The following tables provide summary information regarding our consolidated investments and preferred equity and loan investments.
Consolidated Investments
Number of
Average Year
Ownership
Average
%
Operating Investment Name
Market / Location
Units (1)
Built
Interest
Rent (2)
Occupied (3)
Ballast
AZ / CO / WA
84
1998
95
%
$
2,104
90.5
%
Golden Pacific
IN / KS / MO
169
1977
97
%
1,715
92.3
%
ILE
TX / SE US
482
1991
95
%
1,838
95.8
%
Indy-Springfield, formerly Peak JV 1
IN / MO
334
1999
100
%
1,266
95.3
%
Navigator Villas
Pasco, WA
176
2013
90
%
1,587
97.7
%
Peak JV 2
Various / TX
596
1980
80
%
1,292
89.3
%
Peak JV 3
Dallas-Fort Worth, TX
150
1961
56
%
1,112
100.0
%
Savannah-84, formerly Peak JV 4
Savannah, GA
84
2022
100
%
1,749
97.6
%
Wayford at Concord
Concord, NC
150
2019
83
%
2,176
97.3
%
Yauger Park Villas
Olympia, WA
80
2010
95
%
2,400
95.0
%
Total Operating Units / Average
2,305
$
1,597
94.1
%
Development Investment Name
Abode Wendell Falls (4)
Wendell, NC
170
—
100
%
—
—
Total Development Units
170
Total Units
2,475
(1) Total operating units includes an aggregate of 118 units classified as held for sale and includes the following portfolios: 35 units in Indy-Springfield, 13 units in Peak JV 2, and 70 units in Peak JV 3.
(2) Represents the average of the ending average effective rent per occupied unit as of the last day of each month in the three months ended December 31, 2023.
(3) Percent occupied is calculated as (i) the number of units occupied as of December 31, 2023 divided by (ii) total number of units, expressed as a percentage. Percent occupied excludes an aggregate of 60 down/renovation units.
(4) Abode Wendell Falls is a build to rent development project expected to commence construction in the second quarter 2024. The total estimated project cost is $56.0 million, of which $6.5 million was incurred as of December 31, 2023.
Preferred Equity and Loan Investments
Total Actual/
Actual/
Estimated
Actual/
Actual/
Actual/
Planned
Construction
Estimated
Estimated
Estimated
Estimated
Number
Cost
Cost to Date
Construction
Initial
Construction
Average
Lease-up Investment Name
Location / Market
of Units
(in millions)
(in millions)
Cost Per Unit
Occupancy
Completion
Rent (1)
The Woods at Forest Hill
Forest Hill, TX
76
$
17.1
$
17.1
$
225,000
4Q 2022
3Q 2023
$
1,625
Willow Park
Willow Park, TX
58
17.1
17.1
294,828
2Q 2022
3Q 2023
2,362
The Cottages at Myrtle Beach
Myrtle Beach, SC
294
63.2
61.7
214,966
2Q 2023
4Q 2023
1,743
The Cottages of Port St. Lucie
Port St. Lucie, FL
286
69.6
63.8
243,357
2Q 2023
1Q 2024
2,133
Wayford at Innovation Park
Charlotte, NC
210
62.0
40.4
295,238
3Q 2023
3Q 2024
1,994
Total Lease-up Units
924
Development Investment Name
Chandler
Chandler, AZ
208
48.2
39.6
231,731
2Q 2024
3Q 2024
1,920
Total Development Units
208
Operating Investment Name
Number of Units
Average Rent (1)
Peak Housing (2)
IN / MO / TX
452
$
1,009
Total Operating Units
452
Total Units / Average
1,584
$
1,687
(1) For lease-up and development investments, represents the average pro forma effective monthly rent per occupied unit for all expected occupied units upon stabilization. For operating investments, represents the average effective monthly rent per occupied unit for the three months ended December 31, 2023.
(2) Peak Housing is a stabilized operating portfolio and the number of units shown represents those collateralizing our preferred equity investment in the Peak REIT OP as of December 31,2023 (refer to Note 8 of our combined consolidated financial statements for further information). Unit count excludes units presented in the consolidated investments table above.
58
Table of Contents
Item 3. Legal Proceedings
We are not party to, and none of our properties are subject to, any material pending legal proceeding.
Item 4. Mining Safety Disclosures
Not applicable.
59
Table of Contents
PART II