Company: INVH
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001687229-25-000008
Chunk: 66

Company: Invitation Homes Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 66
---
 business and operations. As part of our ERM program, our functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning and includes risks identified by our Cybersecurity Governance Committee and information technology and cybersecurity functions as part of the overall review of significant enterprise risks. The top ERM risks are compiled annually and shared with the audit committee of the board of directors as well as the full board of directors. In addition, internal audit incorporates these risks into its continuous risk assessment process.Where appropriate, we seek to include in contractual arrangements with certain of our third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit, and test such vendors’ cybersecurity programs and practices. We also utilize a number of digital controls to monitor and manage third-party access to internal systems and data.We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves. As a backstop to our strong information security programs, policies, and procedures, we purchase a cybersecurity risk insurance policy that would defray the costs of an information security breach, if we were to experience one.Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions, and other events of varying degrees. To date, we have not experienced a material security breach, nor are we aware of any third-party outside service providers that have experienced a cybersecurity breach. As a result, we have not incurred any significant expenses from information security breaches or any penalties or settlements related to the same. As of December 31, 2024, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, our results of operations, or our financial condition. For a discussion of risks from cybersecurity threats that could materially affect us, please see Part I. Item 1A. “Risk Factors — Risks Related to Information Technology, Cybersecurity, and Data Protection.”

Governance

Since August 2020, our Vice President, Chief Information Security Officer (“CISO”) has led a team of information security professionals who have the first line responsibility for our cybersecurity risk management processes and activities. Our CISO has more than 20 years of experience as an information security leader responsible for assessing and managing cybersecurity programs