Company: RWT-PA
Filing Date: 2025-04-01
Form Type: DEF 14A
Source: 0000930236-25-000012
Chunk: 10

Company: REDWOOD TRUST INC
Filing Date: 2025-04-01
Form: DEF 14A
Chunk 10
---
 responsible for cybersecurity and information technology (“IT”) risk, and oversees management’s administration of Redwood’s cybersecurity risk management program. For example, officers within Redwood’s IT department provide periodic (generally at least once per quarter) reports from management to the Audit Committee related to cybersecurity, Redwood’s cybersecurity risk management program and related risks, with copies of these reports also provided to our full Board. These reports supplement materials and presentations from outside experts that are also provided to members of the Board of Directors from time to time as part of the Board’s and Audit Committee’s continuing education on risk oversight topics such as cybersecurity that impact companies in our industry and, more generally, publicly-traded companies. In addition, management has policies and procedures in place to provide event-driven updates on a timely basis to the Audit Committee and the Board of Directors regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Additional discussion of Redwood’s Cybersecurity Risk Management and Strategy, as well of Cybersecurity Governance at Redwood is included within Part I, Item 1C of the Company’s Annual Report on Form 10-K for the year ended December 31, 2024, filed on March 3, 2025.

In addition, when appropriate, the Board of Directors may delegate to the Compensation Committee and Governance and Nominating Committee risk oversight responsibilities with respect to certain matters or request that other committees review certain risk oversight matters. For example, the Compensation Committee has been delegated the responsibility for determining, on an annual basis, whether Redwood’s compensation policies and practices are reasonably likely to have a material adverse effect on Redwood. As another example, the Governance and Nominating Committee reports to the Board of Directors the results of its analysis of potential risks related to board leadership and composition, board structure, and executive succession planning.

The Board of Directors believes that this manner of administering the risk oversight function effectively integrates oversight into the Board of Directors’ leadership structure, because the risk oversight function is carried out both at the Board level as well as through delegation to the Audit Committee, which consists solely of independent directors, and, when appropriate, to the Compensation Committee and Governance and Nominating Committee, which also consist solely of independent directors.

<div align='center'>7</div>

#### Board of Directors’ Self-Evaluation Process
The Board believes it is important to periodically assess its own performance and effectiveness in carrying out its strategic and oversight role with respect to the Company. The Board evaluates its performance through annual self-assessments at the