Company: KBSR
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001482430-25-000021
Chunk: 198

Company: KBS Real Estate Investment Trust III, Inc.
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1C
Chunk 198
---
ITEM 1C.   CYBERSECURITY

Risk Management and Strategy

As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors.  As such, we rely on our advisor’s cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats.  Our cybersecurity program, as implemented by our advisor and overseen by our board of directors, is fully integrated into our overall risk management system, and included as part of our information technology security incident response plan.  The cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (“NIST”).  These processes include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.  

42

Table of Contents

Our advisor conducts annual cybersecurity training to ensure all employees are aware of cybersecurity risks and conducts monthly phishing e-mail simulations.  Annually, our advisor engages a third party to conduct penetration testing to assess our cybersecurity measures and to review our information security control environment and operating effectiveness.  Our advisor also uses a third-party platform to monitor our information security continually.  The results of such assessments and reviews are reported to the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments.  In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate.  For any software platforms that are hosted by third parties, our advisor requires the vendor to maintain a System and Organization Controls (“SOC”) 1 or SOC 2 report.  Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.  As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.  However, future incidents could have a material impact on our business strategy, results of operations, or financial condition.  For additional information, see “Item 1A. Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or