Company: UHG
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001830188-25-000012
Chunk: 76

Company: United Homes Group, Inc.
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1C
Chunk 76
---
Item 1C. Cybersecurity

Risk Management and Strategy

UHG recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. UHG has cybersecurity and risk management processes in place to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. UHG leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover. UHG monitors its systems to assess cybersecurity risks and threats. UHG’s information technology (IT) security team reviews enterprise risk management-level cybersecurity risks and reports on these findings. In addition, UHG has a set of company-wide policies and procedures that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.Managing Material Risks & Integrated Overall Risk ManagementUHG has integrated cybersecurity risk management into its broader risk management framework. This integration ensures that cybersecurity considerations are an integral part of UHG’s decision-making process. Members of UHG’s management work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with UHG’s business objectives and operational needs. Engage Third Parties on Risk ManagementRecognizing the complexity and evolving nature of cybersecurity threats, UHG’s IT personnel incorporate external resources and advisors as needed on cybersecurity planning, reporting, and monitoring. These third-party relationships enable UHG to leverage specialized knowledge and insights, to ensure UHG’s cybersecurity strategies and processes are aligned with industry best practices. In addition to collaboration with various third parties, all of UHG’s employees are required to complete cybersecurity training at least once every three years and also have access to more frequent cybersecurity training through online training courses.Oversee Third Party Risk

35

Table of Contents

UHG utilizes various third-party software applications in the functioning of its core business. UHG conducts assessments of all third-party providers and maintains ongoing reviews to ensure compliance with its cybersecurity standards. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report,