Company: RITM-PC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001556593-25-000007
Chunk: 147

Company: Rithm Capital Corp.
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 147
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We prioritize the management of cybersecurity risk and regularly assess any risk of cybersecurity threats. In doing so, we continuously monitor and test our information systems for potential vulnerabilities pursuant to our cybersecurity program. Our cybersecurity program, led by our interim Chief Information Security Officer (“CISO”), is part of our overall enterprise risk management program, along with other significant risks that we face. Our dedicated cybersecurity personnel supervise and monitor our controls, technologies, systems and other processes utilized to mitigate any data loss, theft, exploitation, unauthorized access or other vulnerabilities that may affect our information or data. Specifically, our cybersecurity program consists of incident response procedures, information security and vendor management due diligence, as well as participation in industry consortiums, ongoing monitoring, internal and independent testing of information systems and continuous employee education and simulations. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit team and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, 

67

SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption “Business—Regulations”), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.Additionally, in order to reduce cybersecurity risks related to our use of third-party service providers, we (i) obligate our service providers to adhere to strict privacy and cybersecurity measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is assigned a tiered risk rating, which determines the frequency and extent of evaluation for the service provider. Furthermore, we collect and evaluate SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents for our key service providers.To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect us. Refer to the risk factor captioned “Cybersecurity incidents and technology disruptions or failures