Company: AOMN
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0001766478-25-000019
Chunk: 116

Company: Angel Oak Mortgage REIT, Inc.
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1C
Chunk 116
---
Item 1C. Cybersecurity

Risk Management and Strategy

Angel Oak Capital, an affiliate of our Manager, has engaged a third-party managed information technology service provider (the “IT Service Provider”), to serve as Angel Oak Capital’s dedicated information technology manager. We have no employees and are externally managed by our Manager, an affiliate of Angel Oak Capital, and as such rely on our Manager for the implementation and execution of our risk management program, and, as it pertains to the assessment, identification, and management of material risks from cybersecurity threats, our Manager relies on the IT Servicer Provider. As an affiliate of Angel Oak Capital, our Manager is subject to and participates in the cybersecurity policies and procedures of Angel Oak Capital.  The IT Service Provider provides Angel Oak Capital a system and organization controls report on itself consistent with SOC 2® as part of annual reviews of the IT Service Provider. Members of the IT Service Provider have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk.As part of its overall enterprise risk management program, Angel Oak Capital has developed an information security framework (the “Cybersecurity Program”). The purpose of the Cybersecurity Program is to mitigate the risks associated with unauthorized attempts to access Angel Oak Capital’s (including our) network for unintended purposes. The Cybersecurity Program is used to assess and understand risks involving information systems and to provide controls and procedures for mitigating those risks and promptly responding to cybersecurity threats and incidents.The IT Service Provider has implemented processes and procedures to assess, identify, manage and protect against material risks from cybersecurity threats including 24/7 network monitoring, ongoing vulnerability and penetration assessments, and employee security awareness training.The IT Service Provider provides Angel Oak Capital with regularly scheduled status reports, including summaries of vulnerabilities, any cybersecurity threats or incidents and the status of responses, and meets with Angel Oak Capital’s Chief Operating Officer and Angel Oak Capital’s Head of Information Technology (the “Head of IT”) on a regular basis to review the reports and the IT Service Provider’s services. In addition, the IT Service Provider and Angel Oak Capital have established a notification and escalation framework, based on the severity of a cybersecurity threat or incident, to determine when and to whom the IT Service Provider will provide notifications regarding cybersecurity threats or incidents. The framework includes notification to the Head of IT. Depending on their nature, incidents may also be reported to members of our management, the Audit Committee of our Board of Directors and to our full Board of Directors, as appropriate. In