Company: NLY-PF
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001043219-25-000012
Chunk: 62

Company: ANNALY CAPITAL MANAGEMENT INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 2
Chunk 62
---
 risk 

69

ANNALY CAPITAL MANAGEMENT, INC. AND SUBSIDIARIESItem 2. Management’s Discussion and Analysis 

indicators. Our Operational Risk Management team conducts a disaster recovery exercise on an annual basis and periodically conducts other operational risk tabletop exercises. Employee-level lines of defense against operational risk include proper segregation of incompatible duties, activity-level internal controls over financial reporting, the empowerment of business units to identify and mitigate operational risk sources, testing by our internal audit staff, and our overall governance framework.

Operational Risk Management responsibilities are overseen by the ERC. The ERC is responsible for supporting the Operating Committee in the implementation, ongoing monitoring, and evaluation of the effectiveness of the enterprise-wide risk management framework. This oversight authority includes review of the strategies, processes, policies, and practices established by management to identify, assess, measure, and manage enterprise-wide risk.

Cybersecurity is part of our enterprise-wide risk management framework. Processes for assessing, identifying and managing cybersecurity risks include cybersecurity risk assessments, use of key risk indicators, vendor cybersecurity risk management, employee training, including phishing exercises and cybersecurity awareness training, penetration testing, evaluation of cybersecurity insurance and periodic engagements by our internal audit department, which validates whether our cybersecurity program and information security practices align with relevant parts of the National Institute of Standards and Technology (“NIST”) framework. We periodically engage penetration testing companies and law firms to assist in these processes. When we do so, we hire reputable companies, limit their access to only information necessary for the specific purpose and maintain security controls around confidential information, including personal information. We also maintain a Cybersecurity Incident Response Plan (“Response Plan”) with processes to identify, contain, mitigate and escalate cybersecurity incidents, utilizing cross-functional expertise and external resources as needed. We conduct periodic tabletop exercises to test our Response Plan and our reaction to various business disruption events, and the results of these tabletop exercises are reported to the Cybersecurity Committee and the ERC.

We also have processes in place to oversee and identify material risks from cybersecurity threats associated with our use of third party service providers upon which we depend to perform various business processes related to our operations,  including mortgage loan servicers and sub-servicers. Our vendor management and IT policies establish procedures for engaging, onboarding and monitoring the performance of third party vendors. For mortgage loan servicers and sub-servicers, these procedures include assessing a vendor’s financial health as well as oversight of its compliance with applicable laws and regulations, cybersecurity and business continuity programs and security of personal information. We also have processes to evaluate and