We face risks that threaten the confidentiality, integrity and availability of our systems and information associated with IT security breaches, whether through cyber-attacks or cyber intrusions over the Internet, malware, computer viruses, software vulnerabilities, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, and other significant disruptions of our IT networks and related systems. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Emerging threats include the use of artificial intelligence ("AI") to automate and enhance cyberattacks, generate sophisticated phishing attempts, bypass traditional security controls, and exploit vulnerabilities more efficiently. AI-powered attacks may increase the speed and complexity of cyber threats, making detection and response more challenging. Our IT networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations and, in some cases, may be critical to the operations of many of our tenants. A security breach or other significant disruption involving our IT networks and related systems could:
- Disrupt the proper functioning of our networks and systems;- Result in misstated financial reports, violations of loan covenants and/or missed reporting deadlines;- Result in our inability to properly comply with or monitor our compliance with the rules and regulations regarding our qualification as a REIT;- Result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of proprietary, confidential, sensitive or otherwise valuable information of ours or others, which others could use to compete against us or for disruptive, destructive or otherwise harmful purposes and outcomes;- Require significant management attention and resources to remedy any damages that result;- Subject us to claims for breach of contract or failure to safeguard personal information, damages, credits, penalties or termination of leases or other agreements;- Damage our reputation among our tenants, prospective sellers, brokers and investors generally; and - Subject us to legal liability, including liability under the California Consumer Privacy Act of 2018 and other state and federal laws.
To help us better identify, manage, and mitigate these IT risks, we use the National Institute of Standards and Technology (NIST) cybersecurity framework as a guide for our cybersecurity risk management program. Additionally, our Technology department requires each employee upon hire, and at least annually thereafter, to successfully complete various security awareness training courses. Further, all employees are required to complete bi-monthly micro training modules. Our Technology department conducts periodic simulated social engineering exercises that may include, but are not limited to, simulated phishing (e-mail), vishing (voice), smishing (SMS), USB testing, and physical assessments. These tests are conducted at random throughout the year with no set schedule or frequency. Additionally, we may conduct targeted exercises against specific departments or individuals based on a risk determination. From time to time our employees may be required to complete additional cyber awareness training courses or receive personalized training from our Technology department staff based on outcomes of random testing or as part of a risk-based assessment. Given the rise of AI-driven cyber threats, our training efforts now include education on AI-generated phishing attacks.
On a quarterly basis we conduct third-party internal and external vulnerability assessments from our cybersecurity firm leveraging the Common Vulnerability Scoring System (CVSS), and on a bi-annual basis we conduct third party social engineering and cyber penetration testing with an information security company that specializes in conducting such tests. We currently maintain insurance policies to insure against breaches of network security, privacy liability, media liability, data incident response expenses, cyber related business interruption, and cyber extortion, although there is no guaranty that the insurance limits and coverage will be sufficient to cover any loss.
To further address IT security, the Audit Committee and the current chairperson of the Company's nominating and corporate governance committee of the board of directors, provides board level oversight of information security and receives quarterly information security reports from our Technology department, while the full board of directors typically receives information security updates annually from senior leadership (in addition to ongoing updates on as-needed basis). Management has overall responsibility for implementing the Company's cybersecurity risk management program and works closely with our Technology Department in this regard to stayed informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.
Over the prior four years, the Company has not been subject to any material information security breaches to our knowledge, has not incurred any material financial harm from information security breaches, nor has the Company been subject to any material information security breaches or expenses to our knowledge since our initial formation.
Although we make efforts to maintain the security and integrity of these types of IT networks and related systems, and we have implemented various measures to manage the risk of a security breach or disruption, including the engagement of independent third party consultants to analyze and remediate any vulnerabilities, implementation of software and systems intended to monitor systems and devices on our network to reduce the risk of IT security breaches and improve our ability to detect a breach, the engagement of a cyber forensics company who can assist our investigation in the event of a breach, and ongoing cybersecurity education and training for employees throughout the year, there can be no assurance that our security efforts and measures will always be effective or that attempted security breaches or disruptions would always be thwarted or mitigated. We regularly experience attempted cyberattacks and other incidents, and we expect such attacks and incidents to continue in varying degrees. Even the most well-protected information, networks, systems, and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and may not be recognized until after being launched against a target. AI-driven threats, including AI-generated malware and automated attack strategies, further exacerbate this risk, as they may evade detection by traditional security measures. Because we make extensive use of third-party suppliers and service providers, such as cloud services that support our operations, successful cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk.