Company: KW
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001408100-25-000084
Chunk: 71

Company: Kennedy-Wilson Holdings, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 71
---
Item 1C.     Cybersecurity

Risk management and strategy 

We have implemented and maintain a cybersecurity risk management program that includes information security processes designed to prevent, detect, remediate, and manage material risks from cybersecurity incidents and threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data (“Information Systems and Data”).  We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).  This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.Our cybersecurity risk management program includes:•risk assessment processes to monitor, evaluate and identify risks to our Information Systems and Data;•a multidisciplinary team, including members from our executive management team, our information security and technology function, and legal team (internal and engaged external experts) to identify, assess, and manage cybersecurity threats and risks;•security tools throughout our IT environment to monitor for and identify cybersecurity risks and incidents;•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;•technical, physical, and organizational measures, processes, standards, and/or policies to address cybersecurity threats to our Information Systems and Data;•cybersecurity awareness training of our employees, incident response personnel, and senior management; and•a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Please refer to “Item 1A. Risk factors” in this annual report on Form 10-K, including “Our 

28

Table of Contents

business could be adversely affected by security breaches through cyber-attacks, cyber intrusions or otherwise.”, for additional discussion about cybersecurity-related risks. 

Governance 

Our Board of Directors holds oversight responsibility over the Company’s strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Audit Committee of the Board of Directors (the “Audit Committee”) oversees the management of systemic