Company: KBSR
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001482430-25-000021
Chunk: 199

Company: KBS Real Estate Investment Trust III, Inc.
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1C
Chunk 199
---
 otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems.”

Governance

Our board of directors is responsible for understanding the primary risks to our business, including risks from cybersecurity threats.  The board of directors is responsible for reviewing our advisor’s cybersecurity policies with management and evaluating the adequacy of the program, compliance and controls with management.  

Our advisor’s Information Technology Director reports at least annually to our board of directors and to our audit committee as appropriate.  These presentations include developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties.  Our board of directors also receives prompt and timely information regarding any cybersecurity incidents that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.  These reports come from a member of our advisor’s Executive Committee, comprised of our advisor’s key executives and certain department leaders.

Our advisor has formed a Cyber Governance Committee (“CGC”), comprised of our advisor’s Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor’s Chief Executive Officer (also our Chairman of the Board of Directors) and our advisor’s Chief Financial Officer (also our Chief Financial Officer), material risks, if any, from cybersecurity threats.  The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes.  Our advisor’s Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.  In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.  Our advisor’s Information Technology Director and Executive Committee are responsible for our incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats.  Our advisor’s Information Technology Director also coordinates with consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.

Our advisor’s Information Technology Director has over 15 years of prior management experience in digital technologies.  He has over 10 years of experience in creating and implementing procedures for managing Payment Card Industries Security Standards (PCI), SOX Cybersecurity measures to include ransomware, email phishing, and data breaches