Company: CMCT
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000908311-25-000017
Chunk: 135

Company: Creative Media & Community Trust Corp
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1B
Chunk 135
---
 the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee has relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and have multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.The Committee has established a Cybersecurity Subcommittee (the “Subcommittee”). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC’s cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC’s cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules. The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group’s IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee’s and the Subcommittee’s respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, 

49

Table of Contents

regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM Group maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM Group’s business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.CIM Group’s personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.

Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or