Company: NXDT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001356115-25-000003
Chunk: 918

Company: NEXPOINT DIVERSIFIED REAL ESTATE TRUST
Filing Date: 2025-03-31
Form: 10-K
Item: Item 9C
Chunk 918
---
Item 1B. Unresolved Staff Comments

None.

Item 1C. Cybersecurity

The Company’s Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company’s risk management program, and cybersecurity represents an important component of the Company’s overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the “NIST CF”) and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company’s information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur. 

As one of the critical elements of the Company’s overall risk management, our cybersecurity program is focused on the following key areas: 

Governance: The Board’s oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the “Audit Committee”), which interacts with our Adviser’s Director of Information Technology and other members of management of our Adviser that implement and oversee our Adviser’s cybersecurity program. 

Risk Assessment: No less frequently than annually, our Adviser completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company’s cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company’s security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Adviser. To supplement our Adviser’s internal assessment, our Adviser also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.

Technical Safeguards: Our Adviser deploys technical safeguards that are designed to protect the Company’s and our Adviser’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. 

Incident Response and Recovery Planning: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis. 

Third-Party Risk Management: Our Adviser maintains a comprehensive, risk-based approach to