Company: VRE
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000924901-25-000011
Chunk: 141

Company: Veris Residential, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 141
---
 to evaluate its cybersecurity controls. In addition to the NIST CSF, the Company also completed third-party technical testing of its information technology systems architecture. 

20

Table of Contents

To operate its business, the Company engages certain third-party vendors to perform a variety of functions. The Company seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Company’s vendor management procedures including reviewing the cybersecurity procedures, imposing contractual requirements, and conducting periodic reassessments as needed. The Company seeks to further enhance this review to expand the scope and depth of this analysis. As a result of these factors, the Company has adopted a strategic multi-year cybersecurity plan.  This plan is not meant to be all encompassing as the cybersecurity landscape shifts and evolves, and the Company is continually assessing its risks and the evolving cybersecurity threat landscape. This plan includes implementing additional and/or fortifying existing defenses and capabilities necessary to protect and preserve the integrity of the Company’s information assets and mitigate the risks to the Company’s business operations.  As part of this plan, the Company requires regular cybersecurity training for all employees and periodically conducts tests to assess employee comprehension and evaluate training effectiveness.  The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.

Governance

The Company’s Audit Committee holds oversight responsibility over the cybersecurity strategy and risk management.  The Audit Committee engages in regular discussions with executive management regarding the Company’s significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. The Company prepares a quarterly report from the Chief Operating Officer and the CISO which includes updates on the Company’s current cybersecurity maturity, progress on the Company’s previously mentioned multi-year cybersecurity plan, strategy updates to combat changes in the threat landscape, education of employees and executive management on cybersecurity awareness, enhanced cybersecurity defenses, incident response programs and regulatory reporting obligations. The Audit Committee delivers a summary of these reports to the full Board of Directors on a quarterly basis. Furthermore, the Board of Directors receives a direct report from the CISO on no less than an annual basis, with interim reports provided when appropriate or necessary.  

As part of the Company’s incident response plan, a committee known as the Cyber ERM (Enterprise Risk Management) Committee has been established comprising cross-functional representation across