Company: DBRG
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001679688-25-000017
Chunk: 92

Company: DigitalBridge Group, Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 92
---
Item 1C.  Cybersecurity.

As an investment manager, our business is highly dependent on information technology networks and systems. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have purchased cybersecurity insurance, but there are no assurances that the coverage would be adequate in relation to any incurred losses. As of December 31, 2024, we have not experienced any material incidents from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.

Cybersecurity Risk Management and StrategyThe Company’s risk management program is headed by its Chief Information Officer, Vice President of Cybersecurity and its Cybersecurity Architect. Collectively, they possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and are able to leverage their extensive cybersecurity experience to effectively manage risk. The Company’s information technology (“IT”) team is led by the Company’s Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company’s IT team meets on a recurring basis, and at least quarterly, with senior members of the Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks.  Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization.In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company’s IT environment, provide recommendations to strengthen the program, and provide updates on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related the portfolio companies of our funds. The Company assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company’s IT team conducts a series of sessions to discuss and evaluate risks and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework.