Company: MITN
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001514281-25-000026
Chunk: 113

Company: AG Mortgage Investment Trust, Inc.
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1C
Chunk 113
---
 Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business.”, for additional discussion about cybersecurity-related risks. 

Governance

Our Board of Directors holds oversight responsibility over the Company’s strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Board regularly engages in discussions with management regarding the Company's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Directors (the “Audit Committee”) oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee engages in regular 

47

discussions with management regarding the Company’s significant financial risk exposures and the measures implemented to monitor and control these risks. 

Our Board of Directors, including the Audit Committee, is briefed on our Manager’s information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents.  The Chief Information Security Officer reports at least annually to our Board of Directors, including the Audit Committee, and such report may address overall assessment of the Company’s compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

As an externally managed company, we rely on our Manager and its affiliates’ information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG.  TPG has established an Enterprise Risk Committee (“ERC”) to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG’s Chief Executive Officer.  TPG has also established an Operational Risk Committee (“ORC”) which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG’s Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within the organization, including compliance, human resources, internal audit and legal. The CISO leads TPG