Company: GTY
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000950170-25-019976
Chunk: 43

Company: GETTY REALTY CORP /MD/
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 43
---
Risk Management and StrategyWe have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan. This plan was developed with support from our Audit Committee and in consultation with key stakeholders across our organization to ensure it accurately reflects their respective roles and responsibilities. The plan has been selectively disseminated throughout our organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents.We design and assess our program based on industry standards to align closely with information security frameworks and guidelines. This does not imply that we meet or are in compliance with any particular technical standards, specifications, or requirements, only that we use the frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect our information and data and alert us to potential information security breaches. The third party engaged by us to oversee and host our network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees. We previously engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO27001. Management reviewed the results of the assessment with the Audit Committee and worked with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. While we have not experienced any cybersecurity incidents to date, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity incidents in the future. For additional information, see “Item 1A. Risk Factors—Risks Related to Our Business and Operations—We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our