Company: FR
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000921825-25-000019
Chunk: 62

Company: FIRST INDUSTRIAL REALTY TRUST INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 62
---
 employees; (ii) utilize a password manager to protect encrypted passwords of power users; (iii) disable system and physical access of terminated employees in a timely manner; (iv) utilize two-factor authentication for remote access to the network; and (v) segregate internal network through the use of internal firewalls;

•Maintain physical security at our data center and backup recovery location including door access control system   with surveillance; 

•Block data intrusion to maintain confidentiality and integrity of our data via the following: (i) capacity of our servers and networks have an automated monitoring system; (ii) patch management controls on our key software including monitoring resources for patch criticality and reported issues as well as running vulnerability scans; (iii) change logs are kept and updated on all of our key software; (iv) all major changes to hardware and infrastructure devices are performed and approved prior to production migration; (v) remote access is fully encrypted for all users; and (vi) internal firewalls are used to limit access to sensitive systems and applications; and

•Maintain controls and processes relating to payments we make to third parties by using a combination of internal controls around the setup, maintenance and archiving of records to reduce fraud and erroneous payments.  

20

We continually monitor our information system in order to detect anomalous activity and verify the effectiveness of our protective measures. In connection with this phase, we do the following:

•Run extended detection and response software on our network at all times, which is comprehensive company-wide personal computer device security monitoring and active threat remediation software that is fully supported by staff and backed by a prevention warranty;

•Engage third-party specialists to periodically perform: (i) penetration testing, which is a simulated cyberattack against our computer system, in order to assess our ability to resist potential threats and attacks from external and internal sources; (ii) cyber dwelling, which determines if a threat actor has made its way or could make its way into our computer network and if confidential information was or could be compromised; and (iii) tabletop mock cybersecurity incident exercises to gauge our ability to react to an attack;

•Evaluate the technical control structure and competency for all new third-party software vendors and review “cloud” third-party software vendor’s Service Organization Control reports, or reasonable substitutes, which give comfort on the maturity of the vendor’s security controls; and 

•Perform monthly mock phishing email exercises with our employees and provide additional training if needed. 

We have plans in place in order to respond to detected cybersecurity incidents: 

•Maint