Company: CIMO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006426
Chunk: 99

Company: CHIMERA INVESTMENT CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 99
---
 Incident Response Team, which now includes legacy Palisades employees.  We are conducting comprehensive risk assessments to identify additional steps that may be necessary to fully align the legacy Palisades information systems and cyber security practices with our systems and practices.  To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition. For further discussion, please see the risk factor titled “We are dependent on information technology and systems, including those of third parties, and their failure, including through a cyber-attack, could significantly disrupt our business or result in the disclosure or misuse of confidential or other information, including personal information, which could damage our reputation, result in regulatory sanctions, subject us to litigation and/or increase our costs and cause losses that have a material adverse impact on our business, financial results and financial condition” in Item 1A. “Risk Factors” in this Annual Report on Form 10-K.

Governance

Our Board of Directors, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our CISO on, among other things, the threat landscape, the Company’s cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company’s overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk - Risk Management" included in this 2024 Form 10-K for additional information on our enterprise risk management.The Company’s CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team also elevate any potential cybersecurity issues, whether internal or at a third party with whom we do business, to the CISO.The Incident Response Team and the non-management employees who support the Incident Response Team identify, assess, respond to and coordinate both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident