Company: EPR-PE
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001045450-25-000051
Chunk: 71

Company: EPR PROPERTIES
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 71
---
Item 1C. Cybersecurity

The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, associates and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

The Company's cyber risk management program is led by the Company's Vice President of Information Systems, whose team is responsible for leading company-wide cybersecurity strategy, policy, and processes while reporting directly to the Company's Chief Financial Officer. While the Board has ultimate oversight for the risk management process, the Audit Committee is responsible for overseeing the Company's policies and procedures for assessing and managing its exposure to risk, including cybersecurity risks. The Company's Vice President of Information Systems provides regular reports to the Audit Committee on any cyber risks and threats to the Company, assessments of the Company's security program and projects in progress to enhance the Company's security systems. The Company's Board of Trustees also receives periodic updates relating to the Company's cybersecurity programs and emerging cybersecurity threats as part of its general oversight duties. Pursuant to the Company's response plan, the Board and the Audit Committee will receive prompt and timely information regarding any material cybersecurity incidents. 

The Company has a documented response plan to follow in the event a cybersecurity incident occurs. The plan details how to determine the scope and risk of an incident, incident response, communication of incident results and risks to all stakeholders and how to reduce the likelihood of an incident occurring or reoccurring. On an annual basis, the Company conducts a test of the cyber response plan in order to test its pre-planned actions, facilitate discussions regarding the plan’s effectiveness and identify useful strategies and tactics learned from the test. Additionally, the Company’s security program is supported by external third-party experts, including outside cybersecurity professionals at a security operations center and expert legal counsel specializing in information technology and cybersecurity. 

The Company's cyber risk management program includes processes for identifying and