Company: NLY-PF
Filing Date: 2025-07-30
Form Type: 10-Q
Source: 0001628280-25-036724
Chunk: 204

Company: ANNALY CAPITAL MANAGEMENT INC
Filing Date: 2025-07-30
Form: 10-Q
Item: Part I, Item 1
Chunk 204
---
 oversight of cybersecurity processes, policies and procedures and management of any cyber-specific events, including escalation to the ERC, the executive leadership team and/or the Board, as appropriate. 

The Cybersecurity Committee includes representatives from Operational Risk Management, Information Technology, Legal, Mortgage Operations and Internal Controls. Certain members of the Cybersecurity Committee have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk. Members also participate in cybersecurity-related professional organizations that discuss industry threats, challenges and solutions to cybersecurity issues.

The Cybersecurity Committee regularly discusses cybersecurity risk management and best practices with the ERC and with the Audit and Risk Committees of our Board. The Audit and Risk Committees jointly oversee processes, practices and policies related to cybersecurity and receive joint and individual presentations from management and external experts on cyber technology-related risks. Two members of our Board have completed the Carnegie Mellon/NACD Cyber-Risk Oversight Program and earned the CERT Certificate in Cybersecurity Oversight and one member of our Board has completed the NACD Master Class: Cyber-Risk Oversight Program.

To date, we have not detected any risks from cybersecurity threats that have materially affected us. However, even though we take steps to employ reasonable cybersecurity defenses, not every cybersecurity incident can be prevented or detected. We also may be held responsible for cybersecurity threats affecting our third party service providers, including servicers and sub-servicers, some of whom have reported breaches in the past. Therefore, while we are not aware of any cybersecurity threats or incidents that are reasonably likely to have a material effect on our business strategy, results of operations, the likelihood and severity of such risks are difficult to predict. For further discussion, please see the risk factors titled “We are highly dependent on information systems and networks, many of which are operated by third parties” and “Cyberattacks or other information security breaches of our Company’s, service providers’ or counterparties’ systems or network affect our business, reputation and financial condition” in Part I, Item 1A. “Risk Factors” of our most recent Annual Report on Form 10-K and in Part II, Item 1A. “Risk Factors” in this Quarterly Report on Form 10-Q.

67

ANNALY CAPITAL MANAGEMENT, INC. AND SUBSIDIARIESItem 2. Management’s Discussion and Analysis 

Compliance, Regulatory and Legal Risk Management

Our business is organized as a REIT, and we seek to continue to meet the requirements for taxation as a REIT. The determination that we