Item 1B. Unresolved Staff Comments
Item 1B.
UNRESOLVED STAFF COMMENTS
None.
28
Table of Contents
Item 1C.
CYBER SECURITY
Risk Management and Strategy
As an externally managed company, our day-to-day operations are managed by our Advisers and our executive officers under the oversight of our Board
of Directors. As such, we rely on our Advisers’ cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats.
Due to the small size of our operations, our Advisers have elected to outsource the information technology function to a third-party managed service provider, or the MSP, that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our Advisers’ hosted services, all of the computer and
computer-related hardware and software used by our Advisers to manage our operations, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate
vulnerabilities, to monitor systems, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP
follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.
The MSP conducts ongoing cybersecurity training to ensure all employees are aware of cybersecurity risks and performs periodic phishing simulation
testing for increased cyber resilience. Annually, the MSP conducts penetration testing to assess cybersecurity measures and to review the information security control environment and operating effectiveness. In addition, our Advisers evaluate key
third-party service providers before granting the service provider access to its information systems and have a process in place to ensure that future access is appropriate. Our assessment of risks associated with the use of third-party providers is part of the Advisers’ overall cybersecurity risk management framework. For any software platforms that are hosted by third parties, our Advisers confirm the vendor maintains a System and Organization Controls (“SOC”) report. While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of third parties who provide services, and in particular certain property management services, at our commercial and residential real estate properties. Although we confirm third party software platforms maintain a SOC report, we rely on third parties for managing their cybersecurity risk. Our Advisers maintain third-party cyber insurance and upon identification of a significant cyber incident involving the Advisers managed IT environment, our Advisers would notify
their cyber insurance carrier.
29
Table of Contents
As of the date of this annual report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property
data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenants, loss of tenant or other
sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control,
including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through “hacking”, “phishing”, or other
forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. As our Advisers have elected to outsource our information technology functions to third-party providers, we bear the risk of having less
direct control over the security and performance of those systems.
Governance
As part of its responsibilities pursuant to our corporate governance guidelines, our Board of Directors oversees our policies with respect to risk
assessment and risk management, including with respect to cybersecurity risks. The Board of
Directors administers its risk oversight function by receiving regular reports from our executive officers on areas of material risk to us, which reports include any updates regarding cybersecurity incidents or other developments.
As discussed above, we engage the MSP to assist us with the identification, monitoring and management of cybersecurity risks and rely on the
expertise and knowledge of the MSP with respect to supporting our information technology network. The MPS reports periodically to our management team as necessary, including our
Chief Executive Officer and Chief Financial Officer. These senior executive officers then brief our Board of Directors on security matters as required and no less frequently than annually. Our Chief Operating Officer is responsible for managing our cybersecurity risk and developing mitigation strategies and implementing controls to reduce the likelihood of a cybersecurity
incident occurring and to reduce the impact of such an incident should this occur.
30
Table of Contents