Company: NXDT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001356115-25-000003
Chunk: 276

Company: NEXPOINT DIVERSIFIED REAL ESTATE TRUST
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 276
---
 The Board’s oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the “Audit Committee”), which interacts with our Adviser’s Director of Information Technology and other members of management of our Adviser that implement and oversee our Adviser’s cybersecurity program. 

Risk Assessment: No less frequently than annually, our Adviser completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company’s cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company’s security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Adviser. To supplement our Adviser’s internal assessment, our Adviser also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.

Technical Safeguards: Our Adviser deploys technical safeguards that are designed to protect the Company’s and our Adviser’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. 

Incident Response and Recovery Planning: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis. 

Third-Party Risk Management: Our Adviser maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company’s and the Adviser’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. 

Education and Awareness: Our Adviser provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Adviser’s evolving information security policies, standards, processes and practices. 

Our Adviser engages in the periodic assessment and testing of our Adviser’s policies, standards, processes and practices that are designed to address the Company’s cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and 

67

creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Adviser