Company: CMCT
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000908311-25-000017
Chunk: 134

Company: Creative Media & Community Trust Corp
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1B
Chunk 134
---
Item 1B.  Unresolved Staff Comments

None.

Item 1C.  Cybersecurity

The Company’s Cybersecurity Risk Management ApproachThe Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group’s cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group’s controls leverage the National Institute of Standards and Technology Cybersecurity Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.In addition, all employees of the Company and CIM Group receive mandatory training on cybersecurity matters upon hiring and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly “phishing” and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.For further discussion of cybersecurity risks, see “Item 1A. Risk Factors—Cybersecurity risks and cybersecurity incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.”Management Oversight of Cybersecurity Risk ManagementCIM Group’s internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the “Committee”) for evaluation. The Committee consists of CIM Group’s Chief Technology Officer (the “CTO”), CIM Group’s Chief Compliance Officer (the “CCO”) and representatives from CIM Group’s operations, compliance and accounting departments. The Committee is responsible for CIM Group’s cybersecurity policy and overseeing the activities of CIM Group’s cybersecurity practices, including assessing CIM Group’s risks and controls. The Committee is chaired by the CTO and has more than 30 years of experience in