SOTHERLY HOTELS LP 10-K Cybersecurity GRC - 2024-03-22

Page last updated on April 11, 2024

SOTHERLY HOTELS LP reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-22 15:32:29 EDT.

Filings

10-K filed on 2024-03-22

SOTHERLY HOTELS LP filed an 10-K at 2024-03-22 15:32:29 EDT
Accession Number: 0000950170-24-035300

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cyberse curity Our Chief Financial Officer is responsible for managing cybersecurity risk. With the assistance of outside consultants, he develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring as well as to reduce the impact of any such incident, should it occur. At least annually, he discusses cybersecurity risk and the Company s mitigation efforts and effectiveness of controls with the Audit Committee of the Board of Directors, which is the committee that has primary responsibility for overseeing our risk assessment and is composed solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risk and reviews the tests of controls performed by consultants that perform the internal audit function. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full Board of Directors. As of December 31, 2023, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have implemented controls to protect our data and information systems and monitor our systems on an ongoing basis, such efforts may not prevent material compromises to our information systems in the future, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and procedures. While we have control over our information systems, we do not have control over the information systems of our hotel manager, Our Town, or of our franchisors. Although we set expectations for Our Town and our franchisors, we rely on them to manage the cybersecurity risk to which they are subject. Our hotel manager maintains separate cybersecurity insurance coverage to offset a portion of potential costs incurred from a security breach. We currently do not have a cybersecurity incident response plan with respect to our data and information systems. We rely on Our Town and their cybersecurity consultants as well as our franchisors, to maintain cybersecurity incident response plans applicable to their systems and hotel-level systems they manage on our behalf. For additional information about cybersecurity risk, see Item 1A. Risk Factors - We and our manager rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. 36

Company Information