Company: KW
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001408100-25-000084
Chunk: 72

Company: Kennedy-Wilson Holdings, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 72
---
 risks, including cybersecurity. The Audit Committee engages in regular discussions with management and engaged consultants and legal advisers regarding the Company’s significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company’s risk assessment and risk management policies. 

Our management, represented by our Chief Financial Officer and Vice President, Information Systems, lead our cybersecurity risk management processes and oversees their implementation and maintenance. Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.    As described above, we also have engaged a third-party IT and cybersecurity firm that works closely with our management to implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Our management and information systems teams, oversee the work of our third-party IT and cybersecurity firm and regularly communicates with members of the team. Members of this third-party IT and cybersecurity team have collectively over 55 years of prior work experience and are responsible for the implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer.  In addition, our Vice President, Information Systems, has 40 years of prior work experience in information systems and technology, including with respect to cybersecurity issues and threats.  Through the policies and controls described above, including our incident response policy, members of our management team, including our Chief Financial Officer, our Executive Vice President, Global Risk Management and our Executive Vice President, General Counsel, as well as representatives of the third-party IT and cybersecurity team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. 

Management, including the Vice President, Information Systems and Executive Vice President, Global Risk Management, serves on the Company’s incident response team to help the Company address cybersecurity incidents. In addition, the Company’s incident response processes include reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee holds quarterly meetings and receives periodic reports from management, including our Chief Financial Officer, concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them.  The Audit Committee also receives periodic reports from the Company's internal audit team with respect to regular network penetration and related tests to ensure that the Company's defense tools, processes and procedures are operating as designed.