Company: CIMO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006426
Chunk: 12

Company: CHIMERA INVESTMENT CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 12
---
 SEC's Office of Compliance Inspections and Examinations cybersecurity guidance.We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements. We collaborate with service providers to help assess the sufficiency of their cybersecurity measures and require service providers to notify us promptly of cyber incidents that may affect our systems or data.

37

Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities and promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.In December 2024, we completed the Palisades Acquisition and have aligned all new employees acquired through such acquisition with our cybersecurity training and governance framework, including the Incident Response Team, which now includes legacy Palisades employees.  We are conducting comprehensive risk assessments to identify additional steps that may be necessary to fully align the legacy Palisades information systems and cyber security practices with our systems and practices.  To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition. For further discussion, please see the risk factor titled “We are dependent on information technology and systems, including those of third parties, and their failure, including through a cyber-attack, could significantly disrupt our business or result in the disclosure or misuse of confidential or other information, including personal information, which could damage our reputation, result in regulatory sanctions, subject us to litigation and/or increase our costs and cause losses that have a material adverse impact on our business, financial results and financial condition” in Item 1A. “Risk Factors” in this Annual Report on Form 10-K.

Governance

Our Board of Directors, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our CISO on, among other things, the threat landscape, the Company’s cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company’s overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk -