Company: FR
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000921825-25-000019
Chunk: 61

Company: FIRST INDUSTRIAL REALTY TRUST INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 61
---
Item  1C.Cybersecurity

Cybersecurity risk is an important and continuously evolving focus for us, and significant resources are devoted to protecting and enhancing the security of computer systems, software, networks and our other technology assets. We have controls and systems in place to safely receive, protect and store information; collect, use, and share that information appropriately; and detect, contain and respond to data security and denial-of-service incidents.  

We identify material cyber risks by continually assessing external threats to understand evolving threats, developing issues and industry trends. Cybersecurity is an important and integrated part of the Company’s enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks. We view our main cyber risk areas to be attempts to gain unauthorized access to our data and computer systems and the data of third parties to which we may owe a duty of care through malware, ransomware, computer fraud, insider threat from persons inside our Company or persons with access to systems inside our Company, and other significant disruptions of our information technology networks and related systems. Our processes and controls to mitigate these cyber risks, categorized by five functional areas, Identify, Protect, Detect, Respond and Recover, are addressed below.  

The first step in our process is to identify the risks related to our data, personnel, devices, systems and facilities. In connection with this phase, we do the following:

•Perform global risk assessments which include information technology risk areas including cyber and, in conjunction with this assessment, we engage leading security and technology vendors to periodically perform specific technical information technology risk assessments;  

•Maintain a matrix that delineates roles and responsibilities for information security supporting significant financial applications, database and networks; 

•Participate in various consortiums, associations and groups to share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas;

•Conduct mandatory information security training for all employees and regularly evaluate their information security awareness and adherence to our information security recommendations; and

•Disclose our computer usage policy on our intranet and require employees to acknowledge the policy annually.

Next, we perform certain controls and processes in order to protect against the identified risks. In connection with this phase, we do the following:

•Maintain controls and processes over access to our networks and computer systems including: (i) approval and restriction to appropriate personnel as well as ensuring powerful privileges are restricted and segregated to select information technology