Bluerock Homes Trust, Inc. 10-K

Item 1B. Unresolved Staff Comments None. Item 1C. Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, incoming (external) physical infrastructure with enhanced firmware, continuous employee training, internal reporting, and monitoring and detection tools. We also engage top third-party security providers for applications and infrastructure to identify, prioritize, assess, mitigate, and remediate risks. Our information technology (“IT”) department regularly assess risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including but not limited to tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have implemented incident response and breach management processes which have four overarching and interconnected stages: (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. Such incident responses are overseen by our Leadership Committee comprised of our Chief Operating Officer, Chief Financial Officer, General Counsel and Senior Vice President of FP&A. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. As part of the above processes, we regularly engage external resources and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. 57 Table of Contents Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from key third parties such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents. Management has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company , including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors, “ We are highly dependent on information systems and therefore systems failures, cybersecurity incidents or other technology disruptions could negatively impact our business” and “Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.” above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. Governance Our Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board and through its committees. The Audit Committee meets annually to review enterprise security, technology risks and cybersecurity threats, risk assessments and areas of emerging risks, incidents and mitigation strategies, and industry trends. Our IT department maintains internal and external resources and is led by our IT Manager and assisted by our Risk Assessment/IT Compliance & Enterprise Manager . These two individuals have a combined 40+ years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. The IT department is responsible for the information security of the organization and for the oversight of all cybersecurity infrastructure and programs. The department provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings. Our Leadership Committee is responsible for the oversight of risks from cybersecurity threats. The Leadership Committee receive updates on a quarterly basis from leaders of our IT department and compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives. Our Leadership Committee and IT department discuss cybersecurity-related current events and any updates to our cybersecurity risk management and strategy programs. Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters. 58 Table of Contents Item 2. Investments As of December 31, 2024, we held twenty-three real estate investments, consisting of fourteen consolidated investments and nine held through preferred equity and loan investments. The following tables provide summary information regarding our consolidated investments and preferred equity and loan investments. Consolidated Investments ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Occupancy – ​ ​ ​ ​ ​ Number of ​ Average Year ​ Ownership ​ Average ​ Occupancy – ​ Excluding Held for ​ Operating Investment Name Market / Location Units (1) Built Interest Rent (2) All Units (3) ​ Sale/Reno Units (4) ​ Scattered Single-Family Homes ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Ballast AZ / CO / WA 84 1998 95 % $ 2,077 97.6 % 97.6 % Golden Pacific IN / KS / MO 169 1977 97 % 1,788 97.6 % 97.6 % ILE ​ TX / SE US ​ 478 ​ 1991 ​ 95 % ​ 1,871 ​ 89.7 % 91.5 % Indy-Springfield IN / MO 323 1999 100 % 1,337 93.8 % 96.2 % Peak JV 2 Various / TX 573 1981 80 % 1,322 88.0 % 92.9 % Peak JV 3 Dallas-Fort Worth, TX 90 1959 56 % 1,286 60.0 % — ​ Savannah-84 Savannah, GA 84 2022 100 % 1,823 92.9 % 92.9 % Total Scattered Single-Family Homes / Average ​ 1,801 ​ ​ ​ $ 1,579 89.7 % 93.8 % ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Residential Communities ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Allure at Southpark Charlotte, NC 350 2014 98 % $ 1,724 92.3 % 92.3 % Amira at Westly ​ Tampa, FL ​ 408 ​ 1999/2023 ​ 93 % ​ 1,945 ​ 92.6 % 92.9 % Avenue at Timberlin Park ​ Jacksonville, FL ​ 200 ​ 2001 ​ 100 % ​ 1,613 ​ 95.0 % 95.5 % Villas at Huffmeister ​ Houston, TX ​ 294 ​ 2007 ​ 95 % ​ 1,560 ​ 94.6 % 94.9 % Wayford at Concord ​ Concord, NC ​ 150 ​ 2019 ​ 83 % ​ 2,166 ​ 95.3 % 96.0 % Yauger Park Villas ​ Olympia, WA ​ 80 ​ 2010 ​ 95 % ​ 2,433 ​ 98.8 % 98.8 % Total Residential Communities Units / Average ​ ​ ​ 1,482 ​ ​ ​ ​ ​ $ 1,840 ​ 93.9 % 94.1 % Total Operating Units / Average ​ ​ ​ 3,283 ​ ​ ​ ​ ​ $ 1,689 ​ 91.6 % 94.0 % ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Development Investment Name ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Residential Communities ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Abode Wendell Fall (5) ​ Wendell, NC ​ 170 ​ — ​ 100 % ​ — ​ — ​ — ​ Total Development Units ​ ​ 170 ​ ​ ​ ​ ​ ​ ​ ​ ​ Total Units ​ ​ ​ 3,453 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ (1) Total operating units includes an aggregate of 167 units classified as held for sale, with such units included in the following portfolios: 8 units of ILE, 37 units of Indy-Springfield, 32 units of Peak JV 2, and all 90 units of Peak JV 3. (2) Represents the average of the ending average effective rent per occupied unit as of the last day of each month in the three months ended December 31, 2024. (3) Percent occupied is calculated as (i) the number of units occupied as of December 31, 2024 divided by (ii) total number of units, expressed as a percentage. (4) Percent occupied is calculated as (i) the number of units occupied as of December 31, 2024 divided by (ii) total number of units, expressed as a percentage, and excludes 167 units classified as held for sale and an aggregate of 7 down/renovation units. (5) Abode Wendell Falls is a build-to-rent development project that commenced construction in 2024. 59 Table of Contents Preferred Equity and Loan Investments ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Total Actual/ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Actual/ ​ Estimated ​ ​ ​ ​ Actual/ ​ Actual/ ​ Actual/ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Planned ​ Construction ​ ​ ​ ​ Estimated ​ Estimated ​ Estimated ​ ​ ​ Estimated ​ ​ ​ ​ Number ​ Cost ​ Cost to Date ​ Construction ​ Initial ​ Construction ​ ​ ​ Average Lease-up Investment Name Location / Market of Units (in millions) (in millions) Cost Per Unit Occupancy Completion % Occupied Rent (1) Willow Park ​ Willow Park, TX ​ 58 ​ $ 17.1 ​ $ 17.1 ​ $ 294,828 ​ 2Q 2022 ​ 3Q 2023 ​ ​ 87.9 % $ 2,362 The Cottages at Myrtle Beach ​ Myrtle Beach, SC ​ 294 ​ ​ 63.2 ​ ​ 63.2 ​ ​ 214,966 ​ 2Q 2023 ​ 4Q 2023 ​ ​ 72.1 % ​ 1,743 The Cottage of Port St. Lucie ​ Port St. Lucie, FL ​ 286 ​ 69.6 ​ ​ 69.5 ​ ​ 243,357 ​ 2Q 2023 ​ 2Q 2024 ​ ​ 85.7 % ​ 2,133 Chandler (2) ​ Chandler, AZ ​ 208 ​ ​ 48.2 ​ ​ 48.2 ​ ​ 231,731 ​ 2Q 2024 ​ 3Q 2024 ​ ​ 46.6 % ​ 1,920 Wayford at Innovation Park (3) Charlotte, NC 210 ​ 62.0 ​ 58.7 ​ 295,238 3Q 2023 4Q 2024 ​ 64.3 % 1,994 Wayford at Pringle Charlotte, NC 102 ​ 37.2 ​ 37.2 ​ 364,706 1Q 2024 4Q 2024 ​ 85.3 % 2,453 Total Lease-up Units ​ 1,158 ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Development Investment Name (4) ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Indigo Cove Bluffton, SC 82 ​ 30.2 ​ 8.3 ​ 368,293 4Q 2025 1Q 2026 ​ — ​ 3,095 River Ford Brunswick, GA 170 ​ 51.6 ​ 10.6 ​ 303,529 4Q 2025 1Q 2027 ​ — ​ 2,004 Canvas at Wildwood ​ Wildwood, FL ​ 224 ​ ​ 60.3 ​ ​ 9.3 ​ ​ 269,196 ​ 4Q 2026 ​ 4Q 2027 ​ ​ — ​ ​ 1,937 Total Development Units ​ 476 ​ ​ ​ ​ ​ ​ ​ ​ Total Units/Average ​ 1,634 ​ ​ ​ ​ ​ ​ ​ ​ ​ $ 2,072 (1) Represents the average pro forma effective monthly rent per occupied unit for all expected occupied units upon stabilization. (2) Chandler commenced lease-up in June 2024. (3) Wayford at Innovation Park commenced lease-up in August 2023. (4) None of the development investments had commenced lease-up as of December 31, 2024. ​ Item 3. Legal Proceedings We are not party to, and none of our properties are subject to, any material pending legal proceeding. Item 4. Mining Safety Disclosures Not applicable. ​ 60 Table of Contents PART II