Company: RWT-PA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000930236-25-000007
Chunk: 285

Company: REDWOOD TRUST INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 285
---
ITEM 1C. CYBER RISK MANAGEMENT, STRATEGY, AND GOVERNANCE DISCLOSURES

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology (“IT”) systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is one aspect of the overall set of policies, procedures and techniques that we employ at the Company to manage risk. Many of the mechanisms for identifying, managing and reporting on cybersecurity risk are integrated into the Company’s broader policies and procedures relating to risk management; however, due to the unique nature of cybersecurity risk, key aspects of our cybersecurity risk management program are intended to function on a stand-alone basis, including to ensure rapid escalation and response to cybersecurity incidents. Our cybersecurity risk management program includes:•Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, operations, and our Company’s overall IT environment;•A team of IT professionals principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) together with our legal/compliance team, our response to cybersecurity incidents;•Use of third-party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, without limitation, periodic penetration testing, network vulnerability and web application scanning, and system monitoring via System Information and Event Management (“SIEM”) or other monitoring tools;•Employee and contractor trainings on information security awareness, data privacy awareness, and phishing/social engineering mitigation, as well as periodic tabletop exercises involving IT professionals and executive management to review roles and responsibilities and walk through practical aspects of responding to cybersecurity incidents; •A cybersecurity incident response plan that sets forth guidelines, policies and procedures for identification, escalation, containment, investigation, remediation, recovery, notification, legal compliance and related processes and actions in response to a cybersecurity incident; and•A risk management process for third-party service providers, suppliers, and vendors, which includes criteria for risk-based categorization of these third parties and policies and procedures relating to assessing their cybersecurity practices prior to engagement and periodic monitoring during the course of engagement.We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”) – i.e., we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but our use of the NIST CSF