Company: SBAC
Filing Date: 2025-04-07
Form Type: DEF 14A
Source: 0001193125-25-074669
Chunk: 24

Company: SBA COMMUNICATIONS CORP
Filing Date: 2025-04-07
Form: DEF 14A
Chunk 24
---
 of the ISO 27001 standard and have achieved ISO 27001:2013 certification for one of our data centers. Key elements of our information security management systems include, among others:

| > | risk assessments; |

| > | organizational structure and responsibilities; |

| > | objectives and targets; |

24 SBA Communications Corporation | 2025 Proxy Statement

| Proxy Summary |     | Proposal 1 |     | Corporate Governance |     | Executive Officers |     | Executive Compensation |     | Security Ownership |     | Proposal 2 |     | Proposal 3 |     | Other Compensation Disclosures |     | Q&A About Voting |     | Other   
 Matters |
|               |     |            |     | ●                    |     |                    |     |                        |     |                    |     |            |     |            |     |                                |     |                  |     |         |

| > | physical and technical safeguards; |

| > | information security incident management; |

| > | regular audits; |

| > | progress reports; |

| > | metrics; and |

| > | continuous improvement of the information security management system. |

We maintain a data incident response and a business continuity management plan to timely, consistently and compliantly address cyber threats that may occur despite our safeguards. The response plan covers the major phases of the incident response process, including (1) preparation, (2) detection and analysis, (3) containment and investigation, (4) notification, which may include timely notice to our Board if deemed material or appropriate, (5) eradication and recovery and (6) incident closure and post-incident analysis. Our response plan is reviewed annually, regularly tested and kept up to date. The scope of this plan is global and includes our business units, regions, subsidiaries and affiliates. Our business continuity management system includes targets and objectives, impact analyses and risk assessments, business continuity procedures, exercise and testing, monitoring and corrective action plans, training and awareness, documentation and data compilation and standards for data centers and servers. We work with third-party industry experts to conduct annual vulnerability assessments and penetration testing. In the past three years, we have not experienced a material information security breach. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from penalties or settlements related to a cybersecurity breach during that time. We maintain a robust privacy compliance program. New hires are required to participate in cybersecurity onboarding training, and current employees are subject to annual cybersecurity training and quarterly phishing awareness training. Our leadership team participates