Company: ADAMM
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001273685-25-000028
Chunk: 216

Company: ADAMAS TRUST, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 216
---
 business recovery actions.•Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks by using the National Institute of Standards and Technology Cybersecurity Framework (the “NIST Framework”) as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan (“DRP”). The DRP prioritizes the swift recovery of information technology systems, data, and infrastructure and the efficient restoration of servers and applications to their normal operational state in the event of a significant disaster.•Insurance. We maintain a breach response insurance policy.

50

Table of Contents

•Enterprise Risk Assessment.  The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants.  The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis.•Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a  service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications.

•Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time. 

Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. The Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis. We also make available periodic cybersecurity training for members of our Board of Directors. 

As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats