Company: MFAN
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001055160-25-000004
Chunk: 302

Company: MFA FINANCIAL, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 302
---
 vendors and service providers are reviewed annually and as otherwise as may be needed.To date, we have not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company or its business strategy, results of operations or financial position; however, we have faced and continue to face a number of cybersecurity risks in connection with our business.  We continue to invest in the cybersecurity and resiliency of our IT systems and to work to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. “Risk Factors – Cybersecurity Risks.”

Governance

Our Board of Directors is responsible for our cyber risk oversight, as part of our risk management framework.  Our management, primarily through our Chief Technology Officer, provides updates to the Board on a quarterly basis and otherwise as may be needed regarding material matters with respect to cyber risk assessment and overall status regarding our IT systems and controls, including cybersecurity threats during the previous quarter and risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations.  Our management also coordinates with our IT department to help ensure that cyber risks are integrated into our overall risk identification, management and mitigation strategies, subject to our Board’s guidance. As described above, our Chief Technology Officer works with our IT Steering Committee and other members of senior management, including our staff, in assessing the materiality of a cyber risk after a preliminary assessment by our IT department. If a cyber risk is material, our Chief Technology Officer will bring such risk to our Board’s attention.

Our Chief Technology Officer has served in various roles in IT and information security for over 20 years.  In addition, members of the IT department involved in Information Security have an average of 15 years of experience in cybersecurity as well as relevant educational experience.  

35