Company: KW
Filing Date: 2025-03-03
Form Type: 424B3
Source: 0001408100-25-000092
Chunk: 57

Company: Kennedy-Wilson Holdings, Inc.
Filing Date: 2025-03-03
Form: 424B3
Chunk 57
---
We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

Our cybersecurity risk management program includes:

• risk assessment processes to monitor, evaluate and identify risks to our Information Systems and Data;

• a multidisciplinary team, including members from our executive management team, our information security and technology function, and legal team (internal and engaged external experts) to identify, assess, and manage cybersecurity threats and risks;

• security tools throughout our IT environment to monitor for and identify cybersecurity risks and incidents;

• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

• technical, physical, and organizational measures, processes, standards, and/or policies to address cybersecurity threats to our Information Systems and Data;

• cybersecurity awareness training of our employees, incident response personnel, and senior management; and

• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Please refer to “Item 1A. Risk factors” in this annual report on Form 10-K, including “ Our

<div align='center'>28</div>

business could be adversely affected by security breaches through cyber-attacks, cyber intrusions or otherwise. ”, for additional discussion about cybersecurity-related risks.

#### Governance
Our Board of Directors holds oversight responsibility over the Company’s strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Audit Committee of the Board of Directors (the “Audit Committee”) oversees the management of systemic risks, including cybersecurity. The Audit Committee engages in regular discussions with management and engaged consultants and legal advisers regarding the Company’s significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company’s risk assessment and risk management policies.

Our management, represented by our Chief Financial Officer and Vice President, Information Systems, lead our cybersecurity risk management processes and oversees their implementation and maintenance. Management is responsible for hiring appropriate