MacKenzie Realty Capital, Inc.

Risk Management and Strategy

As an externally managed company, our day-to-day operations are managed by our Advisers and our executive officers under the oversight of our Board of Directors. As such, we rely on our Advisers’ cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats.

Because none of our executive officers or other members of management has specialized cybersecurity expertise, such as prior professional cybersecurity experience, cybersecurity certifications, or advanced degrees in cybersecurity, information security, or a related field, our Advisers have elected to outsource the information technology function to a third-party managed service provider (the “MSP”) that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our Advisers’ hosted services, all of the computer and computer-related hardware and software used by our Advisers to manage our operations, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.

The MSP conducts ongoing cybersecurity training to ensure all employees are aware of cybersecurity risks and performs periodic phishing simulation testing for increased cyber resilience. Annually, the MSP conducts penetration testing to assess cybersecurity measures and to review the information security control environment and operating effectiveness. In addition, our Advisers evaluate key third-party service providers before granting the service provider access to its information systems and have a process in place to ensure that future access is appropriate. Our assessment of risks associated with the use of third-party providers is part of the Advisers’ overall cybersecurity risk management framework. For any software platforms that are hosted by third parties, our Advisers confirm the vendor maintains a System and Organization Controls (“SOC”) report. While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of third parties who provide services, and in particular certain property management services, at our commercial and residential real estate properties. Although we confirm third party software platforms maintain a SOC report, we rely on third parties for managing their cybersecurity risk. Our Advisers maintain third-party cyber insurance and upon identification of a significant cyber incident involving the Advisers managed IT environment, our Advisers would notify their cyber insurance carrier.

As of the date of this annual report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenants, loss of tenant or other sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through “hacking”, “phishing”, or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. As our Advisers have elected to outsource our information technology functions to third-party providers, we bear the risk of having less direct control over the security and performance of those systems.

Governance

As part of its responsibilities pursuant to our corporate governance guidelines, our Board of Directors oversees our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Board of Directors administers its risk oversight function by receiving regular reports from our executive officers on areas of material risk to us, which reports include updates regarding cybersecurity incidents or other developments.

None of our executive officers or other members of management have specialized cybersecurity expertise, such as prior professional cybersecurity experience, cybersecurity certifications, or advanced degrees in cybersecurity, information security, or a related field. Instead, as discussed above, we engaged the MSP, which specializes in fully managed information technology and cybersecurity services, to supply that expertise, and we rely on the knowledge and capabilities of the MSP with respect to identifying, assessing, monitoring, and managing cybersecurity risks and supporting our information technology network. The MSP reports periodically to our management team, including our Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer, on the status of our information technology environment and any identified cybersecurity threats, vulnerabilities, or incidents. Our Chief Operating Officer, working with the MSP, oversees our day-to-day cybersecurity risk management, including reviewing mitigation strategies and controls recommended by the MSP and coordinating our response to any cybersecurity incident.