6 unchanged sentences
Our Advisor’s cybersecurity approach incorporates a layered portfolio of comprehensive employee training programs, multiple resources to manage and monitor the evolving threat landscape and knowledgeable teams responsible for preventing and detecting cybersecurity risks.
−Removed: Net Lease Office Properties 2023 10-K – 19
−Removed: As part of our Board’s oversight of risk management, our Board of Trustees will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor.
+Added: As part of our Board’s oversight of risk management, our Board will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor.
These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor’s employees.
−Removed: Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board of Trustees.
−Removed: Our Board of Trustees will receive periodic education around cybersecurity risks and best practices.
+Added: Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board.
+Added: Our Board will receive periodic education around cybersecurity risks and best practices.
Additionally, our Audit Committee, which consists solely of independent trustees, is responsible for overseeing cybersecurity risks and related initiatives.
1 unchanged sentence
It also reviews the steps our Advisor has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.
−Removed: Our Advisor’s information technology team is led by its Chief Information Officer who has extensive experience working with information security systems.
+Added: Our Advisor’s information technology team is led by its Chief Information Officer who reports to its Chief Financial Officer and has extensive experience working with information security systems.
Our Advisor’s information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor’s senior management, our Advisor’s cybersecurity governance committee, the Audit Committee and the Board.
4 unchanged sentences
Our Advisor employs a variety of measures to prevent threats related to privacy, information technology security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, vulnerability scanning and penetration testing.
−Removed: Our Advisor’s information technology and internal audit teams utilize frameworks based on industry standards to identify and mitigate information security risks and oversee an active cybersecurity training program.
−Removed: For example, in January 2023, our Advisor’s information technology team held a tabletop exercise with senior management of the Advisor to consider different cybersecurity scenarios.
−Removed: Our Advisor’s information technology team also recently worked with various third-party consultants to update our incident response plan.
−Removed: In addition, our Advisor’s information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor’s employees to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed.
−Removed: Our Advisor’s internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.
+Added: Our Advisor’s information technology and internal audit teams utilize frameworks consistent with well-recognized industry cybersecurity frameworks to identify and mitigate information security risks and oversee an active cybersecurity training program.
+Added: In addition, our Advisor’s information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor’s employees and board of directors to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed.
+Added: Our Advisor’s internal audit team evaluates and monitors
+Added: Net Lease Office Properties 2024 10-K – 20
+Added: our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.
Third-party vendors are vetted through our Advisor’s service delivery program to ensure they have an established cybersecurity program.
−Removed: Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain clear visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners.
−Removed: Our Advisor’s managed security provider’s risk operations center will escalate certain alerts regarding third-party vendors directly to the appropriate business partners thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.
+Added: Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners.
+Added: Our Advisor’s managed security provider’s risk operations center will escalate certain alerts regarding third-party vendors directly to the IT Department thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.
Detection and Analysis
−Removed: Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor’s managed cybersecurity provider, notifications from
−Removed: Net Lease Office Properties 2023 10-K – 20
−Removed: our Advisor’s employees, vendors or service providers, and notifications from third party information technology system providers.
−Removed: Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor’s incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.
+Added: Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor’s managed cybersecurity provider, notifications from our Advisor’s employees, vendors or service providers, and notifications from third party information technology system providers.
+Added: Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor’s incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event and assessing the severity of the event.
Containment, Eradication, Recovery, and Reporting
−Removed: In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible, consistent with the procedures in the incident response plan.
−Removed: Containment procedures may include shutting down systems;
−Removed: disconnecting systems from a network, disabling specific ports, protocols, services, functions, etc., disabling access to compromised systems;
−Removed: examining code in a controlled environment and making forensic backups of affected systems for possible legal action for third party forensic analysis.
+Added: In the event of a cybersecurity incident, the incident response team is responsible for containing the cybersecurity incident, consistent with the procedures in the incident response plan.
Once a cybersecurity incident is contained, the focus shifts to remediation.
Eradication and recovery activities depend on the nature of the cybersecurity incident.
−Removed: They may include returning affected systems to an operationally ready state, confirming that the affected systems are functioning normally and implementing, as necessary, additional monitoring to look for future related activity.
+Added: They may include returning affected systems to an operationally ready state and confirming that the affected systems are functioning normally.
Our Advisor has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel, vendors and external insurance brokers.
−Removed: In the event of a cybersecurity incident, we intend to follow the steps outlined in our Advisor’s incident response plan, including notifying our Audit Committee and Board, as appropriate.
+Added: In the event of a cybersecurity incident, the incident response team is responsible for following the steps outlined in our Advisor’s incident response plan, including notifying our Audit Committee and Board, as appropriate.
Cybersecurity Risks
−Removed: As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years.
−Removed: However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams.
−Removed: For a discussion of these risks, see Item 1A.
+Added: As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years.
+Added: However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging.
Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor’s cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.