Company: INVH
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001687229-25-000008
Chunk: 68

Company: Invitation Homes Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 68
---
 department. His expertise includes advising on governance frameworks, supporting board oversight of cybersecurity risk management, and addressing litigation trends and risks associated with cybersecurity breaches.•Our Chief Compliance Officer, who joined the Company in July 2016 and has served in her current role since July 2024, is an experienced public company counsel with over 20 years of combined private practice and in-house experience. She provides expertise in SEC regulations and disclosure requirements, including cybersecurity-related guidance, and ensures compliance with legal standards for disclosing material cybersecurity risks and incidents. In collaboration with internal audit, she helps oversee our ERM program to align cybersecurity initiatives with broader business strategies. She also brings a thorough understanding of breach notification requirements and regulatory responses to cybersecurity incidents.•Our Vice President of Internal Audit, serving since November 2017, brings specialized expertise in identifying internal threats and potential fraud related to cybersecurity through advanced audit techniques. She is skilled in aligning cybersecurity risk assessments with our ERM framework and monitoring the implementation of cybersecurity audit recommendations to ensure their effectiveness over time.The Cybersecurity Governance Committee meets quarterly to review the processes and performance indicators related to prevention, detection, mitigation, and remediation of cybersecurity incidents that could adversely impact business operations.We maintain a cross-functional cyber incident response plan with defined roles, responsibilities, and reporting protocols, which focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the information security team would escalate the issue to the Cybersecurity Governance Committee for initial analysis and guidance. The Cybersecurity Governance Committee, in 

52

consultation with appropriate subject matter experts, would be responsible for determining whether a particular incident alone or in combination with other factors, triggers any reporting and/or further notification responsibilities. The Cybersecurity Governance Committee would designate the primary manager of a cybersecurity incident, identify the parties who should be informed about the incident, and oversee the processes for containment, eradication, recovery, and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, the audit committee and the board of directors would be notified of an incident and kept informed of the mitigation and remediation efforts.

Our CISO and other senior members of information technology personnel regularly report to the audit committee and the board of directors on recent trends in cyber risks and review our strategy to defend our business systems and information against cyber-attacks. From time to time, outside advisors may be invited to brief the audit committee on the current cybersecurity threat landscape and other related topics. 

Our board of directors has an advanced