Company: FOACW
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001828937-25-000009
Chunk: 413

Company: Finance of America Companies Inc.
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1C
Chunk 413
---
Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

                Our Company maintains a comprehensive information technology security program based on the National Institute of Standards (NIST) Cyber Security Framework. The information technology security program aims to protect our Company from cybersecurity threats and ensure the confidentiality, integrity, and availability of our data and systems. To provide such protection, our program implements a significant number of controls, including but not limited to physical and digital access controls, data protection controls, system development controls, acceptable use controls, and monitoring controls. We deploy technical and administrative safeguards, such as firewalls, intrusion prevention and detection systems, anti-malware functionality, and security awareness and phishing prevention training programs, which are regularly evaluated and improved. Further, in the event of a cybersecurity incident, our Company has a Cybersecurity Incident Response Team (the “CSIRT”), consisting of stakeholders from across the Company, to respond appropriately. The CSIRT provides a proactive approach to managing cybersecurity incidents and ensures incidents are controlled as quickly as possible to avoid and minimize the damage to systems, limit impact to client information, protect the Company’s reputation and integrity, and prevent future incidents. The 

59

Company also has a data incident response plan in place that outlines expected actions in the event of a data security incident. The Company prioritizes protecting and informing customers, clients, and employees in the event of a data security incident, as is appropriate.  The Company leverages both internal resources and third-party suppliers as needed for technology assets, systems, and development to support its information technology security program. The Company uses third-party rather than internal resources when the Company determines that using a third-party better meets the needs of the business. Before contracting with a third-party supplier, the Company determines if the vended resource is compliant with Company policies. Formal approval for a third-party supplier is obtained through the appropriate Company processes according to the type of resource provided by the third-party supplier. Third-party vendors can present cybersecurity risks to the Company’s technology resources. The Company has a vendor management team that provides oversight of third-party vendors and engages with the enterprise security team to assess potential cybersecurity risks related to a third-party vendor’s services, both at the time of initial engagement and as part of an annual review process. The enterprise security team considers a number of factors in assessing such risks, including the types of services provided by the third-party vendor, the data and systems the third-party vendor needs to access to provide the services, and the policies and controls the third-party vendor has in place