Company: PSA-PH
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001393311-25-000036
Chunk: 76

Company: Public Storage
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 76
---
 personnel and external counsel or other experts.

Our Board considers cybersecurity risk one of the most significant risks to our business. The Board has delegated to the Audit Committee oversight of cybersecurity, data privacy, and other information technology risks affecting the Company. Our CTO and CISO typically provide quarterly reports to the Audit Committee, which also provides quarterly reports on its activities to the Board. Annually, the Board receives a comprehensive update regarding the Company’s cybersecurity efforts, which may include a cybersecurity tabletop exercise, presentation by third party cybersecurity experts, or similar events. Several members of our Board and Audit Committee have cybersecurity, data privacy, or related experience from their principal occupation or other professional experience.

Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats

Our cybersecurity program focuses on (i) preventing and preparing for cybersecurity incidents, (ii) detecting and analyzing cybersecurity incidents, and (iii) containing, eradicating, recovering from, and reporting cybersecurity events. Prevention and PreparationWe identify and address information security risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements, which provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for security operations center (SOC) services, penetration testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our information technology environment.

19

We assess our cybersecurity program against various frameworks. Our information security program is certified for compliance with the Payment Card Industry Data Security Standard for the safe handling and protection of credit card data. Annually, we are assessed, either internally or by an independent third party, against the National Institute of Standards and Technology (NIST) 800-53 Moderate Baseline. We also utilize reports prepared by our external partners to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies, and we regularly engage external resources regarding emerging threats. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including contractual mechanisms, as well as the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.We employ an information security and training program for our employees, including annual mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees