Company: CMRE-PC
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001140361-25-005199
Chunk: 232

Company: Costamare Inc.
Filing Date: 2025-02-20
Form: 20-F
Item: Item 16K
Chunk 232
---

ITEM 16K.   CYBERSECURITY
-------------------------
 Risk Management and Strategy   
 The safe and efficient operation of our business including, but not limited to, billing, disbursements, accounting, vessel scheduling and vessel operations is dependent on computer hardware and software systems. Information systems are vulnerable to security breaches by computer hackers and cyber terrorists. We rely on industry-accepted security measures and technology to securely maintain confidential and proprietary information maintained on our information systems. Our processes for assessing, identifying and managing material risks from cybersecurity threats include:
   
  
•   periodic discussion and assessment of perceived material risks from cybersecurity;
--------------------------------------------------------------------------------------

•   internal and external system assessments such as penetration and vulnerability testing;
-------------------------------------------------------------------------------------------

•   system protection measures, such as email filtering and access management;
------------------------------------------------------------------------------

•   regular threat monitoring, both against the Company and against other companies in the industry;
----------------------------------------------------------------------------------------------------

•   incident response procedures, for identification, reporting and remediation;
--------------------------------------------------------------------------------

•   analysis of cybersecurity incidents and results of security operations monitoring;
--------------------------------------------------------------------------------------

•   regular employee training;
------------------------------

•   compliance procedures in place designed to assist in complying with mandatory data protection legislation; and
------------------------------------------------------------------------------------------------------------------

•   the existence and periodic review of internal cybersecurity policies.
-------------------------------------------------------------------------

 
 We also have processes to oversee and identify cybersecurity risks from cybersecurity threats associated with our use of our managers and other service providers. More specifically, we periodically discuss with our key third-party managers technical and organizational measures in terms of cybersecurity. In terms of Software as a Service (“SaaS”) providers, we monitor the relevant IT security measures through receiving and assessing third-party assurance reports. The results of these processes are taken into consideration in our annual risk assessment process, during which we identify mitigating actions and new security initiatives.
   
 For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see “Item 3. Key Information—D. Risk Factors—Risks related to our Company—We rely on our information systems to conduct our business, and failure to protect these systems against security breaches could adversely affect our business and results of operations. Additionally, if these systems fail or become unavailable for any significant period of time, our business could be harmed.” which is incorporated by reference into this Item 16K.  

 Table of Contents

 Governance
 
 Our Audit Committee has ultimate responsibility for the oversight of cybersecurity risks and responses to cybersecurity incidents, should they arise.