Company: NLY-PF
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001628280-25-023811
Chunk: 53

Company: ANNALY CAPITAL MANAGEMENT INC
Filing Date: 2025-05-08
Form: 10-Q
Item: Part I, Item 2
Chunk 53
---
 and support functions. Operational risk may arise from internal or external sources including human error, fraud, systems issues, process change, vendors, business interruptions and other external events. We manage operational risk through a variety of tools including processes, policies and procedures that cover topics such as business continuity, personal conduct, cybersecurity and vendor management. Other tools include Risk and Control Self Assessment (“RCSA”) testing, including disaster recovery/testing; systems controls, including access controls; training, including phishing exercises and cybersecurity awareness training; and monitoring, which includes the use of key risk indicators. Our Operational Risk Management team conducts a disaster recovery exercise on an annual basis and periodically conducts other operational risk tabletop exercises. Employee-level lines of defense against operational risk include proper segregation of incompatible duties, activity-level internal controls over financial reporting, the empowerment of business units to identify and mitigate operational risk sources, testing by our internal audit staff, and our overall governance framework.

Operational Risk Management responsibilities are overseen by the ERC. The ERC is responsible for supporting the Operating Committee in the implementation, ongoing monitoring, and evaluation of the effectiveness of the enterprise-wide risk management framework. This oversight authority includes review of the strategies, processes, policies, and practices established by management to identify, assess, measure, and manage enterprise-wide risk.

Cybersecurity is part of our enterprise-wide risk management framework. Processes for assessing, identifying and managing cybersecurity risks include cybersecurity risk assessments, use of key risk indicators, vendor cybersecurity risk management, employee training, including phishing exercises and cybersecurity awareness training, penetration testing, evaluation of cybersecurity insurance and periodic engagements by our internal audit department, which determines whether our cybersecurity program and information security practices align with relevant parts of the National Institute of Standards and Technology (“NIST”) framework. We periodically engage penetration testing companies and law firms to assist in these processes. When we do so, we hire reputable companies, limit their access to only information necessary for the specific purpose and maintain security controls around confidential information, including personal information. We also maintain a Cybersecurity Incident Response Plan (“Response Plan”) with processes to identify, contain, mitigate and escalate cybersecurity incidents, utilizing cross-functional expertise and external resources as needed. We conduct periodic tabletop exercises to test our Response Plan and our reaction to various business disruption events, and the results of these tabletop exercises are reported to the Cybersecurity Committee and the ERC.

We also have processes in place to oversee and identify material risks from cybersecurity threats associated with our use of third party service providers upon which we depend on to perform various business processes related to our operations,