Company: BHM
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0001410578-25-000400
Chunk: 18

Company: Bluerock Homes Trust, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1C
Chunk 18
---
Item 1C.   Cybersecurity

Risk Management and StrategyWe recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, incoming (external) physical infrastructure with enhanced firmware, continuous employee training, internal reporting, and monitoring and detection tools. We also engage top third-party security providers for applications and infrastructure to identify, prioritize, assess, mitigate, and remediate risks.Our information technology (“IT”) department regularly assess risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including but not limited to tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.We have implemented incident response and breach management processes which have four overarching and interconnected stages: (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. Such incident responses are overseen by our Leadership Committee comprised of our Chief Operating Officer, Chief Financial Officer, General Counsel and Senior Vice President of FP&A.Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.As part of the above processes, we regularly engage external resources and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.