Ready Capital Corp

We recognize the importance of implementing and maintaining robust cybersecurity measures designed to safeguard the

confidentiality, integrity and availability of our data and systems. We seek to prevent or reduce risks by providing a

prompt, effective, and skillful response to cybersecurity threats. As a critical component of our overall risk management

process, we have adopted a framework that shares existing methodologies, reporting channels and governance processes

to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by

our Incident Response Team (“IRT”), which is led by the Company’s Chief Technical Officer and the Head of

Infrastructure, and supported by the Chief Financial Officer, Chief Executive Officer and Chief Investment Officer, and

General Counsel. The IRT is responsible for assessing and managing cybersecurity risks, subject to the oversight of our

Board. In particular, our Head of Infrastructure is an experienced information technology professional with over 20 years

of experience in the industry, including oversight of our cybersecurity department. Certain members of the IRT report to

our Board on a quarterly basis regarding the external threat environment, steps taken by us to address and mitigate

cybersecurity risks as well as updates on our readiness to prevent, detect, respond and recover from a potential

cybersecurity incident(“Incident”). We conduct due diligence prior to engaging third-party service providers that have

access to our networks, systems, and/or customer or employee data. Third-party service providers are required to comply

with our policies regarding information security and are contractually required to meet all legal and regulatory

obligations. The Board reviews IRT reports, practices relating to information technology, information security,

cybersecurity, disaster recovery, business continuity, data privacy and data governance; and the Board monitors

compliance with regulatory requirements and industry standards.

In the event of an Incident, the IRT is authorized to take the appropriate steps deemed necessary to identify, assess,

contain, mitigate, and resolve the Incident including by (a) maintaining (i) the Company’s Incident Response Plan in the

event of an Incident, (ii) the Company’s Written Information Security Policy which governs information technology

security policies, and (iii) the Company’s Business Continuity Plan designed to keep all major business systems in

operation in the event of an Incident or other disaster (b) regularly monitoring all Company systems and user accounts

for any suspected Incidents (c) performing quarterly audits on all Company systems and user accounts (d) and general

cybersecurity awareness and data protection training for our employees. In addition, depending on the circumstances of

an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis

communications or public relations firms, investor relations firms and response vendors and we may coordinate with

regulators or law enforcement. We also assess third party risks when determining the selection and oversight of

applicable third-party service providers.

Increased cybersecurity risk due to the diversification of our data across external service providers and cyber Incidents

may adversely affect our business by causing a disruption to our operations, compromise our confidential information

and/or damage to our business relationships, all of which could negatively impact our financial results. As of the date of

this Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably

likely to materially affect us, including our financial position, results of operations and/or business strategy. While we

have not, as of the date of this Form 10-K, experienced a cybersecurity threat or Incident that resulted in a material

adverse impact to our business or operations, there can be no guarantee that we will not experience such an Incident in

the future where we may be unable to implement effective preventative measures in a timely manner.

Further discussion of the potential impacts on our business from cyber intrusions is provided in “Risk Factors” in Part I,

Item 1A of this Form 10-K.

Item 2. Properties