Company: CMRE-PC
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001140361-25-005199
Chunk: 233

Company: Costamare Inc.
Filing Date: 2025-02-20
Form: 20-F
Item: Item 16K
Chunk 233
---
 The Audit Committee is informed periodically regarding the status of initiatives to further reduce cybersecurity risk by the IT function and other functions as needed.
   
 The key individuals responsible for the overall assessment and management of material risks from cybersecurity threats include the head of the IT function of Costamare Shipping and our general counsel. The head of our IT function possesses approximately 25 years of experience with informational technology and cybersecurity risk management and our general counsel employs extensive regulatory, risk assessment and organizational experience in oversight of our internal processes.
   
 They receive information regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents and proceed with necessary actions such as:   
  
•   updating relevant policies and procedures;
----------------------------------------------

•   implementing additional technical and organizational measures to reduce the level of cyber risk;
----------------------------------------------------------------------------------------------------

•   engaging specialized third-party service providers;
-------------------------------------------------------

•   assessing the materiality and determination of disclosure obligations (in the event of a cybersecurity incident); and
-------------------------------------------------------------------------------------------------------------------------

•   reporting to the Audit Committee.
-------------------------------------

 Where events occur that do not escalate to cybersecurity incidents, the details of the relevant assessments are communicated to the general manager on an as-needed basis. However, if we were to become the subject of a cybersecurity incident, according to our policies, the key management would take the following steps:
   
  
•   conduct an incident investigation;
--------------------------------------

•   conduct an incident evaluation and classification;
------------------------------------------------------

•   internal escalation to our executives;
------------------------------------------

•   containment of the incident and recovery of any affected infrastructure;
----------------------------------------------------------------------------

•   conduct a materiality assessment;
-------------------------------------

•   determine reporting obligations; and
----------------------------------------

•   report to the Audit Committee.
----------------------------------
PART III