Company: MFAN
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001055160-25-000004
Chunk: 301

Company: MFA FINANCIAL, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 301
---
Table of Contents

Item 1C.  Cybersecurity.

Risk Management and Strategy

We strive to assess, identify and manage material risks associated with cybersecurity threats.  Our information technology (or IT) department, led by our Chief Technology Officer, is responsible for day-to-day management of potential cybersecurity risks.  As part of its management of cybersecurity risks, the IT department designs and implements technology projects and conducts regular Security Awareness Training of the Company’s employees, which includes simulated cyber threats and phishing exercises.  If a cybersecurity threat is identified, the IT department conducts a preliminary investigation and assessment of such risk, and brings the risk to the attention of our Chief Technology Officer. Our Chief Technology Officer then works with our IT Steering Committee, which is comprised of certain members of our executive management, and our legal personnel, to continue the assessment and make the final determination as to the materiality of such risk. Our IT department, management, and necessary or appropriate third parties collaborate with one another in designing and implementing the response and remediation plan with respect to cyber risks.We have developed an Information Security Program which is designed to, among other things, protect the confidentiality of our data, protect against threats or hazards to our IT systems, safeguard our data resources in a manner consistent with applicable laws and regulations, contractual obligations and industry standards, and maintain our IT systems to meet our operational needs.  The Information Security Program is part of our risk management program, which is overseen by our Audit Committee (and our Board of Directors more generally), receives updates from our Chief Technology Officer on cybersecurity risks and related matters on a quarterly basis and as otherwise as may be needed.We follow industry standards for cyber security risk mitigation, including anti-virus/anti-malware protection, detection and response technologies, intelligent logging and event management, regular penetration testing and remediation.  We use our own monitoring and detection, as well as emerging threat intelligence sources, in our efforts to improve protections from threats and improve internal processes based on cyber threats and risks that are impacting other companies.  Our security posture is further enhanced through the use of third-party tools and services providing full time monitoring and threat response. Our third party management policy is designed to assess and mitigate potential risk posed by vendors and outside service providers.  An initial risk assessment is performed to evaluate multiple aspects of a relationship such as impact to cybersecurity, access to our systems and data, and criticality of the relationship to our day-to-day operations.  The program defines oversight requirements based on the results of the risk assessment.  Critical