Company: TWO-PC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001465740-25-000083
Chunk: 59

Company: TWO HARBORS INVESTMENT CORP.
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 59
---
Table of Contents

Item 1C. Cybersecurity

Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance, processing and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats, as are many other organizations within the financial servicing industry. We continuously monitor and develop our information technology networks and infrastructure to help prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses, and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition. For additional information on these risks, see Item 1A, “Risk Factors” of this Annual Report on Form 10-K.We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following:•industry standard targeted controls and security frameworks, including the National Institute of Standards and Technology (NIST), to protect our environment, including antivirus, antimalware, multi-factor authentication, complex and regularly changed passwords, patch management, email security and firewalls to protect our assets and our ability to maintain operations;•use of technologies to help detect, identify and manage risks within our environments, including endpoint detect and response, security information and event management and vulnerability management;•a formal cybersecurity incident response plan designed to respond to security incidents in a systematic and