Company: PSA-PH
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001393311-25-000036
Chunk: 77

Company: Public Storage
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 77
---
 to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to imitate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.As discussed above, we maintain an IRP that guides our response to a cybersecurity incident. Annually, we test the IRP’s response procedures, including thorough disaster response and business continuity plan exercises. These exercises are intended to challenge and validate our information security response and resources through simulated cybersecurity incidents, including engagement of outside cybersecurity legal counsel, other third-party partners, key internal personnel, executive management, and our Board. Detection and AnalysisCybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, notification from external parties (e.g., our third-party information technology provider), and proactive threat hunting in conjunction with our external partners. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event.Containment, Eradication, Recovery, and ReportingOur IRP sets forth the procedures we follow in responding to a cybersecurity incidents. Once a cybersecurity incident is contained, our focus shifts to remediation and recovery. These activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions and validation of files or data that may have been affected. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.Our IRP provides clear communication protocols, including with respect to members of executive management, internal and external counsel, the Audit Committee and our Board. These protocols include a framework for assessing our SEC and other regulatory reporting obligations related to a cybersecurity incident.

Following the conclusion of an incident, the incident response team will generally assess the effectiveness of the cybersecurity program and IRP and make adjustments as appropriate. 

Cybersecurity Risks

As of December 31, 2024, we have not had any known instances of material cybersecurity incidents, including known third-party provider incidents. However, there can be no assurance that our security efforts and measures, and those of our third-party providers, will be effective