Company: PEB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001474098-25-000039
Chunk: 120

Company: Pebblebrook Hotel Trust
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 120
---
Item 1C. Cybersecurity.

We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. He develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, he reports on this risk and related mitigation work to the Audit Committee of our board of trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full board of trustees regarding any aspect of the program or risks.As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.We have elected to outsource our information technology function to a third-party managed service provider, ("MSP") that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.The MSP and we developed a cybersecurity incident response plan that sets forth roles and responsibilities for the identification, assessment, triage, communication and resolution of cybersecurity incidents.

30

In addition, the MSP performs facility and system penetration tests, compromise assessments and security maturity