Ready Capital Corp

We recognize the importance of implementing and maintaining robust cybersecurity measures designed to safeguard the

confidentiality, security, integrity and availability of our data and systems. We seek to prevent or reduce risks by

providing a prompt, effective, and skillful response to cybersecurity threats. As a critical component of our overall risk

management process, we have adopted a framework that shares existing methodologies, reporting channels and

governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk

management process is led by our Incident Response Team (“IRT”), which is led by the Company’s Chief Technical

Officer and the Head of Infrastructure, and supported by the Chief Financial Officer, Chief Executive Officer and Chief

Investment Officer, and General Counsel. The IRT is responsible for assessing and managing cybersecurity risks, subject

to the oversight of our Board. In particular, our Head of Infrastructure is an experienced information technology

professional with over 20 years of experience in the industry, including oversight of our cybersecurity department.

Certain members of the IRT report to our Board on a quarterly basis regarding the external threat environment, steps

taken by us to address and mitigate cybersecurity risks as well as updates on our readiness to prevent, detect, respond

and recover from a potential cybersecurity incident. We conduct due diligence prior to engaging third-party service

providers that have access to our networks, systems, and/or customer or employee data. Third-party service providers are

required to comply with our policies regarding information security and are contractually required to meet all legal and

regulatory obligations. The Board reviews IRT reports and practices relating to information technology, information

security, cybersecurity, disaster recovery, business continuity, data privacy and data governance; and the Board monitors

compliance with regulatory requirements and industry standards.

In order to identify, prevent, detect, and mitigate cybersecurity incidents, the IRT is authorized to (a)takethe appropriate

steps deemed necessary to identify, assess, contain, mitigate, and resolve a cybersecurity incident including; (b) maintain

(i) the Company’s Incident Response Plan in the event of an incident, (ii) the Company’s Written Information Security

Policy which governs information technology security policies, and (iii) the Company’s Business Continuity Plan

designed to keep all major business systems in operation in the event of an incidentor other disaster;(c) regularly

monitor all Company systems and user accounts for any suspected incidents (d) perform quarterly assessmentsonall

Company systems and user accounts; and(e) conduct general cybersecurity awareness and data protection training for

our employees. In addition, we may engage third parties such as insurance carriers, outside legal counsel, forensic

investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may

coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and

oversight of applicable third-party service providers.

Increased cybersecurity risk due to the diversification of our data across external service providers and cyber incidents

may adversely affect our business by causing a disruption to our operations, compromise our confidential information

and/or damage to our business relationships, all of which could negatively impact our financial results. As of the date of

this Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably

likely to materially affect us, including our financial position, results of operations and/or business strategy. While we

have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material

adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in

the future where we may be unable to implement effective preventative measures in a timely manner.

Further discussion of the potential impacts on our business from cyber intrusions is provided in “Risk Factors” in Part I,

Item 1A of this Form 10-K.

Item 2.