Company: NLY-PF
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001043219-25-000012
Chunk: 211

Company: ANNALY CAPITAL MANAGEMENT INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 1
Chunk 211
---
 testing, evaluation of cybersecurity insurance and periodic engagements by our internal audit department, which validates whether our cybersecurity program and information security practices align with relevant parts of the National Institute of Standards and Technology (“NIST”) framework. We periodically engage penetration testing companies and law firms to assist in these processes. When we do so, we hire reputable companies, limit their access to only information necessary for the specific purpose and maintain security controls around confidential information, including personal information. We also maintain a Cybersecurity Incident Response Plan (“Response Plan”) with processes to identify, contain, mitigate and escalate cybersecurity incidents, utilizing cross-functional expertise and external resources as needed. We conduct periodic tabletop exercises to test our Response Plan and our reaction to various business disruption events, and the results of these tabletop exercises are reported to the Cybersecurity Committee and the ERC.

We also have processes in place to oversee and identify material risks from cybersecurity threats associated with our use of third party service providers upon which we depend to perform various business processes related to our operations,  including mortgage loan servicers and sub-servicers. Our vendor management and IT policies establish procedures for engaging, onboarding and monitoring the performance of third party vendors. For mortgage loan servicers and sub-servicers, these procedures include assessing a vendor’s financial health as well as oversight of its compliance with applicable laws and regulations, cybersecurity and business continuity programs and security of personal information. We also have processes to evaluate and classify cybersecurity risk related to sensitive data held by key third party service providers on their systems.

The Cybersecurity Committee has primary responsibility for these processes to manage cybersecurity risks, under the oversight of the ERC. Daily monitoring of cybersecurity defenses is performed by the IT Infrastructure Team and any issues are escalated to the Cybersecurity Committee as needed. The Cybersecurity Committee regularly meets to discuss both routine oversight of cybersecurity processes, policies and procedures and management of any cyber-specific events, including escalation to the ERC, the executive leadership team and/or the Board, as appropriate. 

The Cybersecurity Committee includes representatives from Operational Risk Management, Information Technology, Legal, Mortgage Operations and Internal Controls. Certain members of the Cybersecurity Committee have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk. Members also participate in cybersecurity-related professional organizations that discuss industry threats, challenges and solutions to cybersecurity issues.

The Cybersecurity Committee regularly discusses cybersecurity risk management and best practices with the ERC and with the Audit and Risk Committees of our Board. The Audit and Risk Committees jointly oversee processes, practices and policies related