5 unchanged sentences
In addition to regularly refining our protection methodology, we focus on identification of, response to, and recovery from a cyber-attack.
−Removed: Our program employs the strengths of people, processes, and technology to protect resident, employee, and organization data.
+Added: Our program employs
+Added: the strengths of people, processes, and technology to protect resident, employee, and organization data.
Cybersecurity Risk Management Processes
−Removed: In managing cybersecurity risks, we follow a structured framework informed by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.
−Removed: This framework provides a comprehensive set of guidelines and leading practices, enabling us to identify, protect, detect, respond, and recover from cyber threats and potential cybersecurity incidents.
+Added: Our cybersecurity policies, processes and practices are informed by well-recognized security frameworks such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.
+Added: The NIST framework and others provide a robust set of guidelines and leading practices, enabling us to identify, protect, detect, respond, and recover from cyber threats and potential cybersecurity incidents.
Regularly benchmarking our cybersecurity measures against the NIST framework helps ensure that our protocols remain robust and current in the face of evolving cyber threats.
−Removed: Our Cybersecurity Risk Management (“CRM”) processes are ingrained in our overall Enterprise Risk Management (“ERM”) process.
+Added: Our Cybersecurity Risk Management (“CRM”) processes are ingrained in our overall ERM process.
As part of our ERM process, department leaders identify, assess and evaluate risks impacting Elme and its operations across several pillars corresponding to significant business processes, including those risks related to cybersecurity.
4 unchanged sentences
Cybersecurity is a distinct pillar of our ERM process.
−Removed: Some of our key risks concerning cybersecurity that are included in our CRM processes include the following:
−Removed: • Data loss and/or damages to systems resulting from malicious or accidental actions of an internal employee,
−Removed: • external parties committing social engineering (e.g., phishing) or business email compromise attacks,
−Removed: • third-party software service providers suffering a cybersecurity incident that has a significant impact on our business, data or ability to operate, and
−Removed: • a ransomware attack resulting in encrypted data and release of confidential company and/or resident information.
−Removed: The Company’s Board of Trustees does not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, financial condition, results of operations, or cash flows.
To manage these risks, we take various actions, including the following:
3 unchanged sentences
• secure insurance coverage for cybersecurity incidents,
−Removed: • routinely benchmark our cybersecurity practices against industry leading frameworks,
+Added: • routinely benchmark our cybersecurity practices against well-recognized frameworks,
• conduct incident response tabletop exercises to test our security countermeasures and incident response program,
−Removed: • engage a third-party firm to audit our cybersecurity procedures,
+Added: • engage a third-party firm to audit our cybersecurity procedures , and
• engage a third-party Managed Security Service Provider to perform network and endpoints monitoring.
These actions help us identify opportunities for improvement in our incident preparedness and response processes.
−Removed: In the event of a cybersecurity incident, we maintain a regularly tested incident response program.
+Added: In the event of a cybersecurity incident, we maintain a regularly tested cybersecurity incident response program (“CIRP”).
Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program enhancements.
3 unchanged sentences
We use third parties for various services such as property management, enterprise resource planning software and cloud computing.
−Removed: The use of third parties exposes us to risks that cybersecurity incidents at a third-party provider would impact Elme’s operations and data security.
−Removed: We identify these risks with our robust evaluation program for our third-party partners, in which we assess third-party cybersecurity controls through a questionnaire and include security terms in our contracts where applicable.
−Removed: We mitigate these risks by assessing cybersecurity practices of new providers, continually reviewing and monitoring the cybersecurity practices of our major service providers and conducting periodic reviews of the cybersecurity strategy and posture of our other significant providers.
+Added: We mitigate potential risks from third parties by assessing cybersecurity practices of new providers, continually reviewing and monitoring the cybersecurity practices of our major service providers, conducting periodic reviews of the cybersecurity strategy and posture of our other significant providers, and including security terms in our contracts where applicable.
We also consider cybersecurity incidents at our third-party providers in our business continuity and disaster recovery planning.
−Removed: We have not experienced any material cybersecurity incidents to date.
−Removed: Notwithstanding the extensive approach we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats.
−Removed: “Risk Factors” for a discussion of cybersecurity risks.
Elme’s leadership is committed to maintaining a secure environment that upholds high standards of privacy and data protection.
1 unchanged sentence
We have documented control procedures that govern access to sensitive data and changes made to critical business systems.
−Removed: Our Cybersecurity Incident Response Plan (“CIRP”) helps ensure timely notification of cybersecurity incidents to management and the Board.
−Removed: Our CIO, has been responsible for the development, enhancement, and oversight of cybersecurity programs in her role as CIO for over a decade at two publicly traded real estate companies.
−Removed: She is a member of the Real Estate Cyber Consortium, the National Multi Housing Council Data Privacy, Security, and Information Management Committee, and the RE-ISAC Cybersecurity Working Group.
+Added: Our CIRP helps ensure timely notification of cybersecurity incidents to management and the Board.
+Added: Our CIO has been responsible for the development, enhancement, and oversight of cybersecurity programs in her role as a CIO for over a decade at two publicly traded real estate companies.
+Added: She is a member of the Real Estate Cyber Consortium, the
+Added: National Multi Housing Council Data Privacy, Security, and Information Management Committee, and the RE-ISAC Cybersecurity Working Group.
The Board is responsible for review and oversight of Elme’s cybersecurity risks and the programs and steps implemented by management to assess, manage and mitigate such risks.
1 unchanged sentence
Executive management provides regular updates during board meetings to help ensure that our trustees are informed about the evolving threat landscape and our risk management strategies.
−Removed: receives a cyber update from the CIO on an annual basis.
+Added: The Board receives a cyber update from the CIO on an annual basis.
The Board receives communications via email from the CIO on topics of interest throughout the year.
+Added: Risks, Threats, and Material Incidents
+Added: As of December 31, 2024, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
+Added: However, we and our third-party providers have been the target of cybersecurity threats and expect them to continue.
+Added: Notwithstanding the extensive approach we take to address cybersecurity, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging.
+Added: “Risk Factors” for further discussion of cybersecurity risks.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.