Company: PSA-PH
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001393311-25-000036
Chunk: 75

Company: Public Storage
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 75
---
ITEM 1C.    Cybersecurity

Public Storage devotes significant resources to protecting and continuing to improve the security of its computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage.

Management and Board Oversight

Our risk management processes include a comprehensive enterprise risk management framework focused on (i) evaluating the risks facing the Company and aligning the Company’s efforts to mitigate those risks with its strategy and risk appetite; (ii) communicating and improving the Company’s understanding of its key risks and responsive actions; and (iii) providing the Board with a defined, rated risk inventory and framework against which the Board can direct its responsibilities to oversee the Company’s risk assessment and risk management efforts. Our cybersecurity program is a key component of our overall enterprise risk management framework.A dedicated team of technology professionals monitors and manages cybersecurity risks. They are led by our Chief Technology Officer (CTO), who has significant experience in senior leadership positions with responsibility for cybersecurity and IT risk management, and our Chief Information Security Officer (CISO), who is a Certified Information Systems Security Professional (CISSP). Their teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our CTO and CISO regularly engage with our Chief Administrative Officer. They also report monthly on cybersecurity matters to our entire executive management team.In the event of an incident that jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated information security incident response plan (IRP). The IRP is overseen by our executive Incident Response Committee (IRC), which consists of our Chief Financial and Investment Officer, Chief Administrative Officer, Chief Legal Officer, and CTO. The IRP guides our internal response to cybersecurity incidents.Pursuant to our IRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements.  While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is generally led by the IRC with support from internal