Company: SLG-PI
Filing Date: 2025-04-22
Form Type: DEF 14A
Source: 0001104659-25-037534
Chunk: 25

Company: SL GREEN REALTY CORP
Filing Date: 2025-04-22
Form: DEF 14A
Chunk 25
---
 ​ | ​ |

| ​ | ​ | ​ | ​ | ​ |

| ​ | ​ | Management​                                                                                                                                                                                                                                                                                                                                                                                                                                                         
 The Company’s management is responsible for day-to-day risk management, including the primary monitoring and testing function for company-wide policies and procedures, and day-to-day oversight of the risk management strategy for the ongoing business of the Company. This oversight includes identifying, evaluating, and addressing potential risks that may exist at the enterprise, strategic, financial, operational, and compliance and reporting levels. | ​ | ​ |

| ​ | ​ | ​ | ​ | ​ |

All committees report to the full Board as appropriate, including when a matter rises to the level of a material or enterprise level risk. We believe the division of risk management responsibilities described above is an effective approach for addressing the risks facing the Company and that the Board leadership structure supports this approach.

TABLE OF CONTENTS

| ​ | OUR BOARD OF DIRECTORS AND CORPORATE GOVERNANCE | ​ | ​ | 31 | ​ |

| ​ | OVERSIGHT OF CYBERSECURITY​                                                                                                                                                                                                                                                                                                                                                                                                                                
 Included in our Board’s oversight and approach to risk management is a focus on cybersecurity. Our cybersecurity program, which is applied across all levels of the Company, is designed to protect our information assets and operations from external and internal cyber threats by seeking to mitigate and manage risks while helping to ensure business resiliency.                                                                                    
 Cybersecurity Oversight                                                                                                                                                                                                                                                                                                                                                                                                                                    
 The Board oversees our risk management process directly and through its committees. Pursuant to the Audit Committee charter, the Audit Committee provides compliance oversight to our risk assessment and risk management policies and the steps management has taken to monitor and mitigate such exposures and risks.                                                                                                                                    
 Our Senior Director, Information Security & Network Systems, in coordination with the Senior Vice President, Information Technology, is responsible for leading the assessment and management of cybersecurity risks, and regularly reviewing and assessing cybersecurity initiatives. They are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.                                              
 The Senior Vice President, Information Technology reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on an as needed basis.                                                                                                                                                                                       
 Risk and Vulnerability Management                                                                                                                                                                                                                                                                                                                                                                                                                          
 We take a risk-based approach to cybersecurity and have implemented policies that are designed to address cybersecurity threats and incidents, including those related to third-party service providers. We assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to