Company: VRE
Filing Date: 2025-04-29
Form Type: DEF 14A
Source: 0000924901-25-000035
Chunk: 37

Company: Veris Residential, Inc.
Filing Date: 2025-04-29
Form: DEF 14A
Chunk 37
---
 has over 30 years of experience in corporate enterprise infrastructure and data security management held at a senior management level, acting in both a corporate as well as consulting role within many highly regulated industries. The CISO is responsible for having successfully developed and implemented several cyber security programs within prominent companies within the retail, financial and life science sectors.

In 2024, the Company further enhanced its cybersecurity posture by adding a full-time Director of Cybersecurity, reporting directly to the CISO. The Director is responsible for assisting in the development, implementation and administration of Veris' cybersecurity program. Like the CISO, the Director has over 25 years of experience in

<div align='center'>21</div>

corporate enterprise infrastructure and date security management as well as multiple certifications (CISSP, CPP, MGM, PSP)

The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. This multi-faceted approach to cybersecurity includes physical, administrative, and technical safeguards. During the year ended December 31, 2023, the Company began utilizing the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), to assess and report to the Company's executive management and Board of Directors on the current maturity of operational and procedural controls for securing and safeguarding the Company's information technology assets. The Company will continue to utilize the NIST CSF to evaluate its cybersecurity controls. In addition to the NIST CSF, the Company also completed third-party technical testing of its information technology systems architecture.

To operate its business, the Company engages certain third-party vendors to perform a variety of functions. The Company seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Company's vendor management procedures include reviewing the cybersecurity procedures, imposing contractual requirements, and conducting periodic reassessments as needed. The Company seeks to further enhance this review to expand the scope and depth of this analysis.

As a result of these factors, the Company has adopted a strategic multi-year cybersecurity plan. This plan is not meant to be all encompassing as the cybersecurity landscape shifts and evolves, and the Company is continually assessing its risks and the evolving cybersecurity threat landscape. This plan includes implementing additional and/or fortifying existing defenses and capabilities necessary to protect and preserve the integrity of the Company's information assets and mitigate the risks to the Company's business operations. As part of this plan, the Company requires regular cybersecurity training for all