Empire State Realty OP, L.P.

Risk Management and Strategy

We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company’s overall risk management framework. We use a combination of internal personnel and third-party service providers to monitor, detect and respond to potential cybersecurity threats.

We maintain a cyber incident response plan that is reviewed periodically and tested through tabletop exercises involving management and other key personnel. We also conduct periodic testing and employee training designed to assess and enhance the effectiveness of our cybersecurity controls.

To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect our business strategy, results of operations or financial condition. Refer to the risk factor captioned “Cyberattacks and any failure to comply with related laws could negatively impact us.” in Part I, ITEM 1A. “Risk Factors” for additional description of cybersecurity risks and potential related impacts on the Company.

Governance

ESRT's Board of Directors oversees cybersecurity risk management, primarily through the Audit Committee. The Audit Committee receives periodic reports regarding cybersecurity risks, strategy and incidents.

Our Chief Technology Officers ("CTOs") are responsible for leading our cybersecurity risk management efforts and reports to the Audit Committee on cybersecurity matters. Our CTOs have extensive experience in information technology and cybersecurity.