Company: FOACW
Filing Date: 2025-05-20
Form Type: 10-K/A
Source: 0001828937-25-000032
Chunk: 111

Company: Finance of America Companies Inc.
Filing Date: 2025-05-20
Form: 10-K/A
Chunk 111
---
 protect from, detect, respond to, and recover from cybersecurity threats and that analyze the various controls put into place by the Company’s information security program. The Company also conducts an annual cybersecurity assessment to identify risks and issues and may conduct more frequent assessments as required by a material change to the Company’s cybersecurity risk. Further, the Company engages third parties to conduct penetration tests to assess the performance of the information technology security program. The results of these assessments and tests are reviewed by the Company’s enterprise security team and senior management and are used to identify areas of vulnerability, which the Company then works to address.

To date, risks from cybersecurity threats have not materially affected our Company or our business strategy, results of operations, or financial condition. However, if we were the subject of a significant cyber-attack or security breach in the future, it could materially affect our Company, as discussed in further detail under “Item 1A. Risk Factors— Risks Related to the Business of the Company — A security breach or a cyber-attack could adversely affect our results of operations and financial condition.”

#### Cybersecurity Governance
Board of Directors Oversight

The Board of Directorsoversees the risks to the Company from cybersecurity threats by periodically reviewing information technology security reports from management, including our Chief Information Security Officer (“CISO”), as well as reports from the Audit Committee of the Board of Directors. These reports also include, as applicable, an overview of any cybersecurity incidents. The Audit Committee provides assistance to the Board of Directors with respect to its oversight of the Company’s technology security and data privacy programs. The Audit Committee is responsible for reviewing the Company’s information technology security controls with the CISO and evaluating the adequacy of the Company’s information technology security program, compliance, and controls with the CISO, which evaluation would include a consideration of any applicable cybersecurity incidents.

#### 63
Management Oversight

We have a dedicated enterprise security team responsible for assessing and managing our material risks from cybersecurity threats. Our enterprise security team is led by our CISO, Drew Robertson, who has extensive experience in cybersecurity. In addition to acting as our CISO, Mr. Robertson currently advises several companies in the Cyber Security Industry and is active in a number of information security communities and groups. Prior to his appointment as CISO in October 2021, he served as our Deputy CISO. Before joining the Company, Mr. Robertson worked for the National Security Agency and the U.S. Army, where he held various leadership positions in computer network defense, computer network exploitation, and intelligence oversight.