Company: BPYPN
Filing Date: 2025-03-21
Form Type: 20-F
Source: 0001545772-25-000008
Chunk: 231

Company: Brookfield Property Partners L.P.
Filing Date: 2025-03-21
Form: 20-F
Item: Item 16K
Chunk 231
---
ITEM 16K.    CYBERSECURITY 
Risk management and strategy
We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute of Standards and Technology Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.
In addition, Brookfield’s employees regularly undergo mandatory continuing cybersecurity and data protection training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The policies, standards, and guidance are structured to help our company respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. Our company modifies its policies, standards, and guidance as needed to adjust to this changing environment.
We conduct due diligence on an investment’s cybersecurity and data privacy programs to identify any material risks that may need to be addressed as part of the acquisition or post-acquisition. We also regularly monitor cybersecurity and data privacy risks through reporting by investments in our portfolio. The effectiveness of these programs is evaluated regularly through both internal and third-party audits.
We may engage third parties from time to time, including to conduct risk assessments and/or audits. We have policies and processes in place to govern third-party access and reduce the risks associated with such access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.
In 2024, we undertook the following initiatives: further enhanced our data protection and threat-intelligence capabilities; improved our processes for third-party risk management; continued mandatory cybersecurity education for all employees; and incorporated social engineering to our phishing simulations.
Data privacy and cybersecurity are one element of our comprehensive approach to strong corporate governance and risk management practices, which also focuses on corporate governance ethics; our board of directors; ethical business conduct; and supply chain and vendor management.
Our systems face cybersecurity risks, and we have in the past experienced threats to and breaches of our data and systems. However, to date