Federal Realty OP LP 10-K Cybersecurity GRC - 2026-02-12

Page last updated on February 12, 2026

Federal Realty OP LP reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2026-02-12 16:12:08 EST.

Filings

10-K filed on 2026-02-12

Federal Realty OP LP filed a 10-K at 2026-02-12 16:12:08 EST
Accession Number: 0000034903-26-000017

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBER SECURITY Our chief information officer, who has over 30 years of experience in managing information systems for real estate companies, heads our internal team of technology professionals who are responsible for managing our cybersecurity risks, which includes identifying our primary areas of risk, establishing processes, procedures, and systems to mitigate those risks and identifying and remediating any breaches that may occur. Cybersecurity risk management falls under our chief legal officer as part of our overall risk management program , which is ultimately overseen by the Audit Committee of the Board of Trustees . Our team is supported by a third party company that we have retained to act as our chief information security officer based on the third party company's experience in preventing cybersecurity incidents, advising clients about appropriate cybersecurity procedures and processes, and assessing the integrity of those procedures and processes. The assessment and management of our cybersecurity risks covers all of our internal systems, the systems of third parties who maintain our data, and our use of artificial intelligence. We rely on our management team's experience in risk management, in consultation with our third party advisor, to appropriately address cybersecurity threats. As part of our processes to manage risks from cybersecurity threats and our use of artificial intelligence, we have developed and enforce company-wide policies related to password encryption, strength and expiration, we require multi-factor authentication where appropriate, conduct regular employee training about our policies and cybersecurity threats, and we have adopted a policy on use of artificial intelligence. We make use of firewalls, end-point protection, backups, redundancies, regular penetration testing, and our systems monitor and flag irregularities in how our information systems are accessed or used. Any known cybersecurity incidents would be reported by our chief information officer to our chief legal officer and disclosure committee for evaluation and remediation, and for a determination of how we might develop further security systems and procedures to address evolving cybersecurity threats. Management provides written and verbal updates to the Audit Committee at least quarterly identifying our primary areas of risk, actions taken or planned to be taken to mitigate those risks, and specific activities undertaken during the quarter, including employee training and the results of that training. Management would also provide updates to seek oversight from the Audit Committee on an ad hoc basis in connection with any material cybersecurity incident, should one occur. We have not experienced any cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition . For more information, see Item 1A. Risk Factors ("We face risks relating to cybersecurity threats that could cause loss of confidential information and other business disruptions").

Company Information