Company: AOMN
Filing Date: 2025-04-02
Form Type: DEF 14A
Source: 0001766478-25-000028
Chunk: 22

Company: Angel Oak Mortgage REIT, Inc.
Filing Date: 2025-04-02
Form: DEF 14A
Chunk 22
---
 have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk.

As part of its overall enterprise risk management program, Angel Oak has developed an information security framework (the “Cybersecurity Program”). The purpose of the Cybersecurity Program is to mitigate the risks associated with unauthorized attempts to access Angel Oak’s (including our) network for unintended purposes. The Cybersecurity Program is used to assess and understand risks involving information systems and to provide controls and procedures for mitigating those risks and promptly responding to cybersecurity threats and incidents.

The IT Service Provider has implemented processes and procedures to assess, identify, manage and protect against material risks from cybersecurity threats including 24/7 network monitoring, ongoing vulnerability and penetration assessments, and employee security awareness training.

The IT Service Provider provides Angel Oak with regularly scheduled status reports, including summaries of vulnerabilities, any cybersecurity threats or incidents and the status of responses, and meets with Angel Oak’s Chief Operating Officer and Angel Oak’s Head of Information Technology (the “Head of IT”) on a regular basis to review the reports and the IT Service Provider’s services.

In addition, the IT Service Provider and Angel Oak have established a notification and escalation framework, based on the severity of a cybersecurity threat or incident, to determine when and to whom the IT Service Provider will provide notifications regarding cybersecurity threats or incidents. The framework includes notification to the Head of IT. Depending on their nature, incidents may also be reported to members of our management, the Audit Committee of the Board and to the full Board, as appropriate. In addition to its engagement of the IT Service Provider, we and/or Angel Oak may engage other third parties, including auditors and consultants, to perform assessments or audits of our and/or its cybersecurity policies and procedures and/or to assist with the evaluation of a cybersecurity threat or incident, among other matters.

The Board holds oversight responsibility over our risk management process, including material risks related to cybersecurity threats. The Board administers this oversight function through its committees, including the Audit Committee and the Affiliated Transactions and Risk Committee. A key part of the Audit Committee’s responsibility is overseeing the Cybersecurity Program.

<div align='center'>13</div>

Certain representatives of Angel Oak, including our Manager, regularly report (not less frequently than annually) to the Audit Committee as well as to the full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Head of IT. Such reporting includes updates on the Cybersecurity Program as it impacts us, the reports and services provided