Company: SACH
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001410578-25-000587
Chunk: 0

Company: Sachem Capital Corp.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1C
Chunk 0
---
Item 1C. Cybersecurity

Risk Management and StrategyWe maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying processes and controls of our program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”). The program is subject to annual risk assessment by a third-party consultant to ensure compliance with the standards of the NIST CSF and to identify, quantify and categorize material cyber risks. In addition, with the assistance of the consultant, we have developed a risk mitigation plan to address cyber risks, and where necessary, remediate potential vulnerabilities. Under this program, we employ additional key practices including, but not limited to, maintenance of an information technology (“IT”) assets inventory, quarterly vulnerability testing, identity access management controls including restricted access of privileged accounts, physical security measures at our offices, maintenance of firewalls and anti-malware tools, ongoing cybersecurity user awareness training, industry-standard encryption protocols, and critical data backups.Our cybersecurity partners, including a technology consultant and other relevant third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to maintain the performance and effectiveness of IT assets, data, and services. The cybersecurity partners provide services including, but not limited to, systems inventory management, vulnerability testing, user management, capacity monitoring, network protection, remote access management, data backups management, infrastructure maintenance, and cyber risk advisory, assessment and remediation. We also maintain a disaster recovery plan to help us quickly recover from an incident during a disruption and help mitigate the impact of certain cybersecurity risks.