Company: TWO-PC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001465740-25-000083
Chunk: 60

Company: TWO HARBORS INVESTMENT CORP.
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 60
---
 complete manner, and involves senior executives, external technical, legal and other resources, including an incident response retainer with our third-party security operations center;•regularly monitoring and assessing our cybersecurity programs using external parties including a third-party 24/7 security operations center and by conducting periodic cyber maturity and risk assessments, penetration tests and other targeted controls assessments;•central systems backup processes and associated disaster recovery plans;•membership in an information sharing and analysis center and other industry groups so that we may stay informed about challenges specific to the financial services industry and contribute to the overall cybersecurity community; and•employee training and awareness programs addressing cybersecurity and data privacy challenges we face in our industry.

Our board of directors is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our Company takes to monitor and mitigate these risks. The board is briefed semi-annually or as needed by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. To assist the board, we also have established a security and privacy steering committee comprised of members of senior management, including our CISO and our Chief Technology Officer, to oversee data privacy, information technology, and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in this role for the Company since 2019 and has supported the Company’s information security function since 2015.To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.