Company: INVH
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001687229-25-000008
Chunk: 65

Company: Invitation Homes Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 65
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

Our operations are highly dependent upon information systems that support our business processes. In the ordinary course of our business, we collect and store certain confidential information such as personal information of our residents and associates and information about our business partners, contractors, vendors, and suppliers. Cyber intrusions could seriously compromise our networks and the information stored therein could be accessed, publicly disclosed, misused, lost, or stolen. As such, we have established information security processes and policies using principles from industry recognized cybersecurity frameworks focused on: (i) developing organizational understanding to manage cybersecurity risks; (ii) applying safeguards to protect our systems; (iii) detecting the occurrence of a cybersecurity incident; (iv) responding to a cybersecurity incident; and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes.Information technology and data security, particularly cybersecurity, are areas of focus for our board of directors and its audit committee. We employ a multi-layered security model that leverages risk-based controls with a focus on protecting our residents’ and associates’ data. We follow a cloud-first approach to enable efficient scaling, robust business continuity, and access to the latest technology innovations. 

50

Our cybersecurity risk management program aims to protect and preserve the confidentiality, integrity, and continued availability of our residents’ and associates’ data and includes controls and procedures for the identification, containment, and remediation of cyber threats.Our cybersecurity risk management program includes, among other key features:•regular cybersecurity risk assessments;•detection and reporting of any cybersecurity events;•independent strategy consultation on enhancement items and processes for cybersecurity tabletop exercises;•robust information security training program that includes annual information security training for all associates, as well as additional role-specific information security training; and•cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident to executive leadership and our board of directors.We assess our cybersecurity risk management program at least annually and regularly review our cyber incident response plan. Our processes and policies also include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats. We also partner with industry leading third parties for regular security audits to ensure we view cybersecurity with a holistic perspective.Our cybersecurity risk management processes are a key element of our Enterprise Risk Management (“ERM”) process, which is designed to identify and evaluate the full range of significant risks to our