Company: LXP
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001444838-25-000023
Chunk: 42

Company: LXP Industrial Trust
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 42
---
 the confidentiality, integrity, or availability of the information technology systems we use, we utilize an incident response plan. Our incident response plan was developed to guide the internal response to incidents taking into account a recognized third party cybersecurity framework. Pursuant to our incident response plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While 

23

Table of Contents

the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the incident response team is made up of two teams: the information security response team and the business response team. The information security response team is generally led by our Chief Operating Officer and includes our CTO/CISO, our Director of Information Technology, our MS Provider account manager, our Chief Financial Officer and other members of our senior leadership. The business response team includes primary and secondary contacts for each impacted business area. These individuals assist with any necessary customer notification procedures. The incident response team regularly reports to senior management, including the CEO, in the event of a significant incident, and our Chief Operating Officer and Chief Financial Officer provide reports to our Audit and Cyber Risk Committee and our Board of Trustees.  

The Audit and Cyber Risk Committee oversees, on behalf of the Board of Trustees, our information technology and cybersecurity strategy and initiatives. Our Board of Trustees has determined that one of the members of our Audit and Cyber Risk Committee is an information technology/cybersecurity expert and has significant experience in, among other areas, emerging technologies and coordinating national security and technology policy. On at least a quarterly basis, our Chief Operating Officer, CTO/CISO and Director of Information Technology report to our Audit and Cyber Risk Committee on information technology matters, including cybersecurity. Our Audit and Cyber Risk Committee provides updates to the Board of Trustees. On a periodic basis, our Audit and Cyber Risk Committee commissions an external assessment of our cybersecurity practices and receives a report from the third-party firm performing our internal audit function. The most recent assessment was completed in 2023.  

Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity ThreatsOur cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from, and reporting cybersecurity events.Prevention and PreparationAs noted above,