PROCACCIANTI HOTEL REIT, INC.

The Company deploys advanced cybersecurity technologies and best practices to deliver a highly secure technology platform for its internal operations and hotels throughout its national portfolio. Our program is built around best practice guidance taken in part from both NIST and PCI DSS framework.

Risk Management and Strategy

We have engaged athird-party IT and cybersecurity firm to assist us in protecting us from cybersecurity threats. Our IT partner has been in business for over 33 years and has a national footprint of 175 offices nationwide. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers.

Processes and procedures include:

We or our third-party manager currently maintain cybersecurity insurance policies that provide coverage for security incidents. Although the risks we face from cybersecurity threats are many and change daily, in the last three fiscal years, we havenot experienced any cybersecurity incidents that have materially affected our operations, strategy, financial positions or operations. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see “Item 1A. Risk Factors — Risks Relating to Our Business — We are increasingly dependent on information technology, and potential cyber-attacks, security problems or other disruption and expanding social media vehicles present new risks.”

Despite the policies and procedures that have been implemented to ensure the integrity of our IT systems, we may not be effective in identifying and mitigating every risk in which we are exposed to, especially newly identified vulnerabilities. Furthermore, the hospitality environment requires that the hotels access information in third party environments that are managed, hosted, and provided by others. As such the company will have difficulties in anticipating and implementing preventive measures that mitigate the harm should a break occur.

Malicious actors, which can operate on a larger and more sophisticated scale, are using various tools and methodologies to gain access to systems. Such attacks are ransomware, denial of service attacks, phishing, social engineering, and other cyberattacks. A breach of these systems either managed by us or a third party may result in the loss of business data, personal information, disruption of business.

Governance

Ourboard of directors isresponsible for overseeing our policies and practices related to corporate governance including cybersecurity risks as well as challenges to our business from evolving technology systems, such as generative artificial intelligence and machine learning. On a quarterly basis, our board of directors and audit committee receive a report from management on our cybersecurity threat risk management processes and strategies. Outside of quarterly meetings, our board of directors and audit committee are notified following any cybersecurity incident and meet to address and identify the cybersecurity threat’s severity levels. Our board of directors and audit committee also review management’s materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.