Company: LXP
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001444838-25-000023
Chunk: 43

Company: LXP Industrial Trust
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 43
---
 we utilize our MS Provider for cloud-based information technology services. This third-party solution includes 24/7 monitoring and is consistent with a well-recognized cybersecurity framework. We also engage a nationally recognized public accounting firm to perform periodic cybersecurity assessments, which entail performing a qualitative current state evaluation of our cybersecurity program in line with specific domains within the recognized third-party framework. In addition, we take the following preventative measures:•We engage a third party to perform internal and external penetration tests on an annual basis.•We require multi-factor authentication and other enhanced security measures for our network and primary applications. •We utilize geolocation-based blocking and mobile device management. We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is employee training on cybersecurity around phishing, malware and other cyber risks. We use a third-party provider of security awareness training and simulated phishing for our email phishing reporting and periodic cyber security training. We maintain comprehensive business continuity and disaster recovery plans, which we update on at least an annual basis and we test through tabletop exercises on an annual basis. We do not maintain any on-premises data or servers.  We are exposed to risks from interactions with vendors and other third parties. To mitigate this risk, we perform due diligence on our vendors and third-party service providers. We believe we work with reputable vendors and require SOC reports from critical vendors and IT service providers.  We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

24

Detection and AnalysisCybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, and notification from external parties (e.g., our third-party information technology provider). Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.  Containment, Eradication, Recovery, and ReportingIn the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our incident response plan. A representative of our third-party information technology provider is a member of the incident response team. Our third-party information technology provider