Company: TWO-PC
Filing Date: 2025-04-02
Form Type: DEF 14A
Source: 0001465740-25-000090
Chunk: 14

Company: TWO HARBORS INVESTMENT CORP.
Filing Date: 2025-04-02
Form: DEF 14A
Chunk 14
---
 and (iv) measuring risk and monitoring risk levels.

Our Risk Oversight Committee’s purpose and responsibilities are more fully set forth in its charter.

Role of Our Board of Directors in Risk Oversight; Cybersecurity Risk

#### Risk Oversight Generally
Our management team is responsible for assessing and managing the risks faced by our company, subject to the oversight of our Board of Directors. Our Board of Directors is responsible for oversight of our company’s risk management processes and for understanding the overall risk profile of our company. In exercising its oversight, the Board relies upon the Audit Committee to assist it in overseeing certain risks related to our company, including the quality and integrity of our financial reports, the performance and independence of our independent external auditor, the performance of our internal audit function and our policies regarding accounting and financial matters and internal controls. The Board also relies upon the Risk Oversight Committee to assist in fulfilling its responsibility to oversee the risks related to our company’s investment activities, including funding and liquidity. The Risk Oversight Committee also assists the Audit Committee in reviewing the guidelines and policies that govern the process by which risk assessment and risk management is addressed by the company through its senior management team, Chief Risk Officer and Risk Management Committee.

Pursuant to our Risk Management Policy, the Chief Risk Officer reports to our Risk Oversight Committee on an annual basis, or more frequently as the circumstances may require, regarding: (i) our company’s risk management practices; (ii) our company’s compliance with the Risk Management Policy; (iii) breaches of or exceptions to the Risk Management Policy; (iv) the membership and composition of the Risk Management Committee; and (v) changes or proposed changes to the Risk Management Policy.

#### Cybersecurity Risk Oversight
We recognize the importance of protecting our information and our information technology (“IT”) systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. With this in mind, we focus on IT and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of IT and cybersecurity measures which are aimed at protecting our information and IT systems to help secure long-term value for our stockholders and other stakeholders.

Our Board of Directors is responsible for overseeing matters relating to our IT and cybersecurity risk exposures and the steps our company takes to monitor and mitigate these risks. The Board of Directors is briefed semi-annually by our senior management and Chief Information Security Officer ("CISO") on cybersecurity matters, or more frequently as the circumstances require. To assist our Board, we also