Company: HOUS
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001398987-25-000020
Chunk: 330

Company: Anywhere Real Estate Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 330
---
Item 1C.  Cybersecurity.

The Board of Directors ("Board") and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.

Risk Management and Strategy

Anywhere views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection and response to ensure holistic coverage of the program and our environments. Prevention. Our cybersecurity program starts with prevention, which includes risk assessment and identification and utilizing that information to design an effective layer of controls as a baseline.Our cybersecurity program includes risk assessment and identification processes that are aligned with our overall enterprise risk management ("ERM") program. As part of the annual integrated risk assessment process, the cybersecurity team works with our ERM, internal audit and legal compliance functions to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes. In evaluating the risks posed by third parties, our cybersecurity program also includes a dedicated function for Third Party Risk Management, that oversees the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process personal information, intellectual property, or other sensitive information. Finally, with regard to compliance risk, we utilize third party firms to help us determine compliance with industry standards and regulations. We also maintain a Data Privacy Steering Committee, which is a group of internal legal, risk and IT professionals, to assist management with fulfilling applicable data privacy regulations. In order to protect our assets, we utilize a multi-layer defense strategy to control who logs on to our network and uses our computers and other devices. We have enforced multi-factor authentication, implemented firewalls, and deployed a VPN alternative solution that delivers a zero trust model for access to our network and resources. We also protect our data through our use of security software, which is regularly updated, encryption of sensitive data, both at rest and in transit, and by conducting regular data backups. We have formal policies for safely disposing of electronic files and old devices and we train all employees annually on cybersecurity and their crucial role