Blue Owl Real Estate Net Lease Trust 10-K Cybersecurity GRC - 2024-03-18

Page last updated on April 11, 2024

Blue Owl Real Estate Net Lease Trust reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-18 09:02:13 EDT.

Filings

10-K filed on 2024-03-18

Blue Owl Real Estate Net Lease Trust filed an 10-K at 2024-03-18 09:02:13 EDT
Accession Number: 0001944366-24-000031

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Our operations are highly dependent on the information systems and technology of Blue Owl, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Blue Owl has provided to us regarding its cybersecurity program that are relevant to us. Cybersecurity Processes and Risk Assessment Blue Owl s cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information (ii) maintaining the security and availability of systems and data (iii) supporting compliance with applicable laws and regulations (iv) documenting cybersecurity incidents and its responses and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties. Blue Owl has implemented an information security governance policy (the ISG Policy ) governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl s cybersecurity program is managed by Blue Owl s Chief Technology Officer and Blue Owl s Head of Technology Infrastructure (together, Blue Owl IT Management ), who report to Blue Owl s Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing Blue Owl s monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl s policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl s processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl s cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ( NIST ). 61 Table of Contents Blue Owl s cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl s compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes. Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl s Cyber Risk Operating Committee (the C-ROC ), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel. Blue Owl s cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl s Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl s Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl s cybersecurity program. Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl s Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl s cybersecurity program, the external threat environment and Blue Owl s programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl s preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents. Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Part I. Item 1A. Risk Factors Risks Related to Our Business and Operations Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships. and Part I. Item 1A. Risk Factors Risks Related to Our Business and Operations Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products.

Company Information