Company: DBRG
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001679688-25-000017
Chunk: 70

Company: DigitalBridge Group, Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 70
---
 systems and technologies. Furthermore, we may identify security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

These risks require continuous and likely increasing attention and resources from us to, among other actions, identify and quantify these risks; upgrade and expand our technologies, systems, and processes to adequately address them; and provide periodic training for our employees to assist them in detecting phishing, malware, and other schemes. This diverts time and resources from other activities. In addition, the cost and operational consequences of responding to a cybersecurity incident or deficiency in our cybersecurity could be significant. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies, procedures capabilities to manage the risk of a cybersecurity incident or disruption, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. Due to the complexity and interconnectedness of our information technology networks and systems, and those upon which we rely, the process of upgrading or patching our protective measures could itself create a risk of cybersecurity issues or system disruptions for the Company, as well as for clients who rely upon, or have exposure to, such information technology networks and systems.

Moreover, data protection laws and regulations in the jurisdictions where we operate often require “reasonable,” “appropriate” or “adequate” technical and organizational cybersecurity measures, and the interpretation and application of those laws and regulations are often uncertain and evolving; there can be no assurance that our cybersecurity measures will be deemed adequate, appropriate or reasonable by a regulator or court. Increased regulation of data collection, use and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business or otherwise harm the Company.

26

While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber-attacks and cyber intrusions increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations. 

Our funds’ portfolio companies also rely on similar systems and face similar risks. A disruption or compromise of these systems could have a material adverse