MILLS MUSIC TRUST 10-K Cybersecurity GRC - 2024-04-01

Page last updated on April 11, 2024

MILLS MUSIC TRUST reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-04-01 11:40:20 EDT.

Filings

10-K filed on 2024-04-01

MILLS MUSIC TRUST filed an 10-K at 2024-04-01 11:40:20 EDT
Accession Number: 0001193125-24-082941

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY The Trust does not have any material internal operations of its own that face material cybersecurity threats and is not a regulated financial institution subject to mandatory cybersecurity compliance under New York law (including, without limitation, the New York Code, Rules and Regulations), and therefore has not adopted any cybersecurity risk management program or formal processes for assessing or monitoring cybersecurity risk. However, the Trust does depend on the digital technologies of the Corporate Trustee and third parties, including EMI, Sony/ATV and their respective affiliates information systems, infrastructure and cloud applications and services. Any sophisticated and deliberate attacks on, or security breaches in, the systems, infrastructure or cloud that benefit the Trust, including those of the Corporate Trustee and third parties, could lead to corruption, misappropriation or miscalculation of the gross royalty income arising from the Catalogue (or calculation of the Contingent Portion related thereto) and/or the Trust s assets, proprietary information and sensitive or confidential data. Because of the Trust s reliance on the technologies of the Corporate Trustee and third parties including EMI, Sony/ATV, their respective affiliates, the Trust also depends upon the personnel and the processes of such parties to protect against cybersecurity threats arising from their own operations in the ordinary course of their respective businesses. The Trust does not employ any operating personnel and has not contracted for the development of processes of its own for the purpose of data security protections and as such may not adequately protect against, or investigate and/or remediate any vulnerability to, cyber incidents. To the best knowledge of the Trustees, as of December 31, 2023, risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Trust, but it is possible that any of these occurrences, or a combination of them, could have material adverse consequences on the Trust, including its results of operations or financial condition. 3 Table of Contents

Company Information