Company: LXP
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001444838-25-000023
Chunk: 41

Company: LXP Industrial Trust
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 41
---
Table of Contents

ITEM 1C. CYBERSECURITY

We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.

Management and Board Oversight

Our enterprise risk management framework was developed in conjunction with a third-party that objectively assessed key stakeholder responses to questionnaires on our operations and business functions, including information technology and cybersecurity. Our internal controls over financial reporting include key controls covering certain information technology and cybersecurity processes that are documented and tested annually.  The Audit and Cyber Risk Committee of our Board of Trustees assists our Board of Trustees on oversight of management in connection with regularly assessing our key risks and engaging in enterprise-wide risk management as they relate to cybersecurity and our technology and information systems, including with respect to strategies, objectives, capabilities, initiatives, policies and investments. We employ a Director of Information Technology who works exclusively on information technology and cybersecurity matters and has significant related experience. Our Director of Information Technology reports to our Chief Operating Officer.  Due to our size and the size of our employee base, we use third-party vendors to assist us with our network and information technology requirements. Since 2019, BDO USA, LLC (“BDO”) has acted as our outsourced chief technology officer/chief information security officer (“CTO/CISO”) and provided us with the following services:•Overseeing the chief security role and informing leadership of cybersecurity risks and the role of staff in protecting information, including, but not limited to:◦Monitoring emerging risks, and suggesting and overseeing implementation of mitigations;◦Overseeing security awareness and training programs; and ◦Reporting significant security events to leadership.•Guidance regarding incidence response, business continuity and disaster recovery program, strategy and testing. •Oversight and guidance on vendor risk management processes and individual vendor profiles.•IT strategy advice.•Monitoring the relationship with our information technology managed services provider.•Technical, policy and procedure recommendations. Together with our Director of Information Technology, BDO regularly reports to our Chief Operating Officer and General Counsel and to the Audit and Cyber Risk Committee of our Board of Trustees on a quarterly basis.  We outsource our information technology managed services to a third-party provider of customized private cloud solutions featuring virtual desktops and servers (“MS Provider”). Our Director of Information Technology, together with BDO, oversees the MS Provider. We maintain a critical systems vendor management program with the assistance of a third-party provider of vendor risk intelligence data, including cybersecurity vulnerabilities, business health and credit risk. In the event of an incident which jeopardizes