Company: MITN
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001514281-25-000026
Chunk: 112

Company: AG Mortgage Investment Trust, Inc.
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1C
Chunk 112
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

The Company’s business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats.  These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Company’s data and systems along with other material risks to its operations.These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats. TPG’s administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning, and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the team’s response readiness capabilities.The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG’s cybersecurity team itself performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG has informed us that it also conducts annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform its evaluation. This does not imply that TPG, its affiliates or we fully meet any particular industry standards, specifications, or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG’s internal audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.

As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to “Item 1A. Risk Factors” in this Annual Report on Form 10-K, including “Risks Related to our Company,