Company: GTY
Filing Date: 2025-03-13
Form Type: DEF 14A
Source: 0001140361-25-008521
Chunk: 67

Company: GETTY REALTY CORP /MD/
Filing Date: 2025-03-13
Form: DEF 14A
Chunk 67
---
 and the full Board of Directors reviews these risks as they may impact the enterprise at large, including with respect to information security and data protection. In addition, the Audit Committee receives timely updates from management about any significant cybersecurity incidents, and those with lesser impact potential. In 2025, the Company’s enterprise risk management report to the Audit Committee and our Board began to include risk assessment and risk management actions relating to GenAI. The full Board of Directors is informed of such actions by the Audit Committee and also receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors are kept abreast of cybersecurity developments through presentations by our Chief Financial Officer or external experts as part of their ongoing education on issues impacting public companies. In connection with its cybersecurity risk management program, the Company has a comprehensive cybersecurity incident response plan. The plan was developed with support from the Audit Committee and in consultation with key stakeholders across the Company to ensure it accurately reflects their respective roles and responsibilities. The incident response plan has been selectively disseminated throughout the organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents. The Company utilizes a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect its information and data and alert it to potential information security breaches. The third party engaged by the Company to oversee and host its network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. The Company conducts mandatory annual cybersecurity training for employees and has information security and data privacy policies and procedures in place applicable to the Company’s directors, officers, and employees. The Company previously engaged an independent third party to conduct a comprehensive cybersecurity assessment based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS) and ISO27001. Management and the Audit Committee have reviewed the results of such assessment and have worked and continue to work with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents in response to the assessment results and through various other measures. For the years ended December 31, 2024, 2023 and 2022, the Company did not experience any material incidents, nor incurred any expenses for penalties or settlements related to any information security breaches. Independence/Qualifications The Audit Committee is composed entirely of non-employee directors. The Board of Directors determined that for the year ended December