Our policies outline processes for identifying, reporting, investigating, and responding to a cyber incident. In the event of such an incident, the CIRT will work with the Cyber Steering Committee to conduct a risk analysis. The committee may also engage other members of management to assess the tangible, intangible and financial impact of the incident. Any breach or cyber incident that meets certain criteria will be communicated by the Cyber Steering Committee to the Corporate Governance and Nominating Committee in a timely manner.
Management researches the latest technologies and trends used by cybercriminals through publications, conferences and discussions with peers and advisors. Cyber threats identified are communicated throughout the Company to promote awareness and assist with mitigating potential risks or breaches. Employees are required to undergo regular security awareness trainings. The Company routinely conducts internal phishing and other exercises to gauge the effectiveness of the trainings and assess the need for continued education and/or areas where improvement may be needed.
As we see increased reliance on information technology in the workplace and our business operations, Urban Edge has employed several measures to mitigate cyber risks. The Cyber Steering Committee is responsible for the risk management program which includes, but is not limited to, identifying cyber risks, the risk severity, risk response, and tracking risk remediation. The Cyber Steering Committee meets (i) at least quarterly to review emerging threats, controls, and procedures, (ii) at least annually with the Corporate Governance and Nominating Committee to discuss trends in cyber risks and our strategy to defend our information against cybersecurity incidents, and (iii) promptly following the occurrence of any material cyber incident.
In addition to a dedicated information technology and cybersecurity team monitoring our daily operations, the Company engages an independent third-party cybersecurity audit firm to periodically review cybersecurity risks and our Incident Response Program. The third-party firm evaluates our preparedness based on several factors including cyber risk assessment, vulnerability management, disaster recovery, and penetration testing. They also simulate attacks on the Company as part of their audit procedures to gauge if our incident response is repeatable and effective and provide recommendations for areas of improvement. Our vendor risk management program requires that critical and/or significant third-party service providers furnish information about their cyber policies to ensure compliance with cybersecurity standards.
We utilize a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework, and Microsoft best practices. Our policies and procedures are reviewed and updated annually by the Cyber Steering Committee and incorporate third-party assessments to benchmark ourselves against industry standards. The Company utilizes advanced endpoint protection, firewalls, intrusion detection and prevention, threat intelligence, security event logging and correlation, and backup and redundancy systems.
We have formal policies and procedures addressing data retention, incident response, asset and device management and have a Disaster Recovery and Business Continuity Committee that meets biannually to review and update our plan, policies, and procedures to align with changes in risk assessment and emerging technologies. In addition, our Information Technology team conducts disaster recovery tests annually and reports results to the Cyber Steering Committee.
Compensation
As part of its oversight of the Company’s executive compensation program, the Compensation Committee considers the impact of the Company’s executive compensation program, and the incentives created by the compensation awards that it administers, on the Company’s risk profile. In addition, the Company reviews all of its compensation policies and procedures, including the incentives that they create and factors that may reduce the likelihood of excessive risk taking, to determine whether they present a significant risk to the Company.
Compensation Committee Interlocks and Insider Participation
During 2025, the following Trustees, all of whom are “independent” as defined under SEC rules and regulations and listing standards of the NYSE, served on our Compensation Committee: Steven H. Grapstein (Chair), Mary L. Baglivo, Norman K. Jenkins and Kevin P. O’Shea. None of our executive officers serve as either a member of the board or the compensation committee of any other company that has any executive officers serving as a member of our Board or Compensation Committee.