Company: NREF
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001786248-25-000004
Chunk: 328

Company: NexPoint Real Estate Finance, Inc.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1C
Chunk 328
---
 and the Manager’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. 

Education and Awareness: Our Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Manager’s evolving information security policies, standards, processes and practices. 

Our Manager engages in the periodic assessment and testing of our Manager’s policies, standards, processes and practices that are designed to address the Company’s cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing. The Audit Committee oversees the Company’s risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Manager. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company’s approach to cybersecurity risk management with our Manager, including the Manager’s Director of Information Technology. The Manager’s Director of Information Technology, in coordination with relevant senior management and personnel of the Manager, which includes our Manager’s Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company’s business continuity plan. To ensure the effectiveness of these controls, the Manager’s technology team continually monitors, hardens, and evolves systems’ security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Manager’s Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.The Manager’s Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager