ANNALY CAPITAL MANAGEMENT INC

We are subject to operational risk in each of our business and support functions. Operational risk may arise from internal or external sources including human error, fraud, systems issues, process change, vendors, business interruptions and other external events. We manage operational risk through a variety of tools including processes, policies and procedures that cover topics such as business continuity, personal conduct, cybersecurity and vendor management. Other tools include Risk and Control Self Assessment (“RCSA”) testing, including disaster recovery/testing; systems controls, including access controls; training, including phishing exercises and cybersecurity awareness training; and monitoring, which includes the use of key risk indicators. Our Operational Risk Management team conducts a disaster recovery exercise on an annual basis and periodically conducts other operational risk tabletop exercises. Employee-level lines of defense against operational risk include proper segregation of incompatible duties, activity-level internal controls over financial reporting, the empowerment of business units to identify and mitigate operational risk sources, testing by our internal audit staff, and our overall governance framework.

Operational Risk Management responsibilities are overseen by the ERC. The ERC is responsible for supporting the Operating Committee in the implementation, ongoing monitoring, and evaluation of the effectiveness of the enterprise-wide risk management framework. This oversight authority includes review of the strategies, processes, policies, and practices established by management to identify, assess, measure, and manage enterprise-wide risk.

Cybersecurity is part of our enterprise-wide risk management framework. Processes for assessing, identifying and managing cybersecurity risks include cybersecurity risk assessments, use of key risk indicators, vendor cybersecurity risk management, employee training, including phishing exercises and cybersecurity awareness training, penetration testing, evaluation of cybersecurity insurance and periodic engagements by our internal audit department, which validates whether our cybersecurity program and information security practices align with relevant parts of the National Institute of Standards and Technology (“NIST”) framework. We periodically engage penetration testing companies and law firms to assist in these processes. When we do so, we hire reputable companies, limit their access to only information necessary for the specific purpose and maintain security controls around confidential information, including personal information. We also maintain a Cybersecurity Incident Response Plan (“Response Plan”) with processes to identify, contain, mitigate and escalate cybersecurity incidents, utilizing cross-functional expertise and external resources as needed. We conduct regular tabletop exercises to test our Response Plan and our reaction to various business disruption events, and the results of these tabletops are reported to the Cybersecurity Committee, the ERC, the Audit and Risk Committees of the Board and the entire Board as appropriate. In addition, our senior management and the Board participate in periodic cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.

We also have processes in place to oversee and identify material risks from cybersecurity threats associated with our use of third party service providers upon which we depend to perform various business processes related to our operations, including mortgage loan servicers and sub-servicers. Our vendor management and IT policies establish procedures for engaging, onboarding and monitoring the performance of third party vendors. For mortgage loan servicers and sub-servicers, these procedures include assessing a vendor’s financial health as well as oversight of its compliance with applicable laws and regulations, cybersecurity and business continuity programs and security of personal information. We also have processes to evaluate and classify cybersecurity risk related to sensitive data held by key third party service providers on their systems.

The Cybersecurity Committee has primary responsibility for these processes to manage cybersecurity risks, under the oversight of the ERC. Daily monitoring of cybersecurity defenses is performed by the IT Infrastructure Team and any issues are escalated to the Cybersecurity Committee as needed. The Cybersecurity Committee regularly meets to discuss both routine oversight of cybersecurity processes, policies and procedures and management of any cyber-specific events, including escalation to the ERC, the executive leadership team and/or the Board, as appropriate.

The Cybersecurity Committee includes representatives from Operational Risk Management, Information Technology, Legal, Investment Groups and Internal Controls. Certain members of the Cybersecurity Committee have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk. Members also participate in cybersecurity-related professional organizations that discuss industry threats, challenges and solutions to cybersecurity issues.

The Cybersecurity Committee regularly discusses cybersecurity risk management and best practices with the ERC and with the Audit and Risk Committees of our Board. The Audit and Risk Committees jointly oversee processes, practices and policies related to cybersecurity and receive joint and individual presentations from management and external experts on cyber technology-related risks. Two members of our Board have completed the Carnegie Mellon/NACD Cyber-Risk Oversight Program and earned the CERT Certificate in Cybersecurity Oversight and one member of our Board has completed the NACD Master Class: Cyber-Risk Oversight Program.

To date, we have not detected any risks from cybersecurity threats that have materially affected us. However, even though we take steps to employ reasonable cybersecurity defenses, not every cybersecurity incident can be prevented or detected. We also may be held responsible for cybersecurity threats affecting our third party service providers, including servicers and sub-servicers, some of whom have reported breaches in the past. Therefore, while we are not aware of any cybersecurity threats or incidents that are reasonably likely to have a material effect on our business strategy, results of operations, the likelihood and severity of such risks are difficult to predict. For further discussion, please see the risk factors titled “We are highly dependent on information systems and networks, many of which are operated by third parties” and “Cyberattacks or other information security breaches of our Company’s, service providers’ or counterparties’ systems or network affect our business, reputation and financial condition” in Part I, Item 1A. “Risk Factors” of our most recent Annual Report on Form 10-K and in Part II, Item 1A. “Risk Factors” in this Quarterly Report on Form 10-Q.