Company: GTY
Filing Date: 2025-03-13
Form Type: DEF 14A
Source: 0001140361-25-008521
Chunk: 21

Company: GETTY REALTY CORP /MD/
Filing Date: 2025-03-13
Form: DEF 14A
Chunk 21
---
 management and the Company’s material financial risk exposures and the actions management has taken to limit, monitor or control such exposures, including with respect to (i) information security and data protection and GenAI, and (ii) climate related risks in the Company’s financial statements as and to the extent required by the applicable rules and regulations promulgated by the SEC or FASB. The Audit Committee oversees risk and conducts reviews on a quarterly or as needed basis, including by working with management as well as with the Company's internal auditors and Independent Public Accountants. The Audit Committee receives quarterly reports from management on the Company’s enterprise risk management practices and risk mitigation efforts, including the Company’s risk assessment and risk management actions regarding information security and data privacy risks, as well as timely updates about any significant cybersecurity incidents, and those with lesser impact potential. Commencing in 2025, these quarterly reports from management to the Audit Committee cover the Company’s risk assessment and risk management actions regarding GenAI. The full Board of Directors is informed of such actions by the Audit Committee and also receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors are kept abreast of cybersecurity developments through presentations by our Chief Financial Officer or external experts as part of their ongoing education on issues impacting public companies.

| GETTY REALTY2025 Proxy Statement |     | 25 |

TABLE OF CONTENTS Corporate Governance and Related Matters ( continued ) Our cybersecurity risk management program includes a comprehensive cybersecurity incident response plan. The plan was developed with support from the Audit Committee and in consultation with key stakeholders across the Company to ensure it accurately reflects their respective roles and responsibilities. The incident response plan has been selectively disseminated throughout the organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents. We also periodically engage an independent third party to conduct a comprehensive cybersecurity assessment based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS) and ISO27001. Management and the Audit Committee review the results of such assessments and engage with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. For the years ended December 31, 2024, 2023 and 2022 we did not experience any material incidents, nor incurred any expenses for penalties or settlements related to any information security breaches. As part of their oversight responsibilities over enterprise risk management and risk mitigation, the Board of Directors and the Audit