Company: DBRG
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001679688-25-000017
Chunk: 93

Company: DigitalBridge Group, Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 93
---
 Based upon this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company’s Chief Executive Officer, and approved by the Company’s Data Protection Team (“DPT”). The DPT consists of the Company’s Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer. Among the risks assessed is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the cybersecurity team conducts due diligence in connection with onboarding new vendors and performs 

37

Table of Contents

annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our IT networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to determine if they were impacted and if any Company data was compromised.

In addition to the foregoing, the Company’s Internal Audit team assesses the design and test the effectiveness of cyber controls, and annually, as part of its internal controls testing, performs a review of service auditor reports for in-scope application vendors.  

Board Oversight

The Company’s board of directors (“Board”) is responsible for overseeing and monitoring our risk management processes, including cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (“Audit Committee”) is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company’s cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) any recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company’s senior management, internal auditors and independent auditors.

Cybersecurity Incident Response Plan

The DPT plays a critical role in the Incident Response Plan (“IRP”) adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and