Disclosure · Form 10-K · fiscal 2025
Medical Properties Trust Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 26, 2026· period ended December 31, 2025· MPT· CIK 1287865· Updated · filing on sec.gov ↗
Medical Properties Trust Inc's Form 10-K for fiscal 2025, filed February 26, 2026, names the Head of Technology as its top security role, with oversight by the Risk Committee.
What Medical Properties Trust's Item 1C says
Medical Properties Trust's Form 10-K for fiscal 2025 states that the Board of Directors, led by members of the Risk Committee, oversees the enterprise risk management process, addressing material risks stemming from cybersecurity threats. The filing states that the CSIRT is led by the Head of Technology.
Board and management oversight
The company's management has primary responsibility for identifying, assessing, and managing its exposure to cybersecurity threats and incidents. The Board of Directors receives regular updates from the Computer Security Incident Response Team (CSIRT) on significant cybersecurity risks, potential impacts on business operations, and management's strategies for addressing these risks. The CSIRT, made up of cross-functional professionals, reviews and assesses cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts.
Who leads security
The Head of Technology leads the CSIRT, and the filing says this person has years of experience in Information Technology.
How the company manages cyber risk
The program includes an annual review and audit of cyber controls and procedures. The company periodically reviews cybersecurity procedures and implements new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology. Security awareness training is provided during employee onboarding, and successful completion is required at least annually for all employees. The company performs employee anti-phishing campaigns at least quarterly. A cybersecurity incident response plan is reviewed annually and generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed.
Third parties and incidents
The company periodically evaluates and reviews cybersecurity risks associated with its use of key third-party business partners, vendors, and service providers. The company has not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect it.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 26, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Head of Technology
Reports to
not identified
Board oversight
Risk Committee
“However, the Board of Directors, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.”
CISO or other person named
not identified
Frameworks and standards named
NIST (publication not named)
Where the filing names it
- NIST (publication not named): “periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology;”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Led by our Head of Technology with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts.”
Material incident
The filing states none
“We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us , including our overall business strategy, results of operations, or financial condition.”
The section
655 words, Form 10-K filed February 26, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 27, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Medical Properties Trust Inc standard industrial classification 6798, Real estate investment trusts (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Ashford Hospitality Trust IncFY 2025, filed March 23, 2026 | Executive Vice President of Technology | Executive Vice President of Asset Management | Audit Committee |
| Strawberry Fields REIT, Inc.FY 2025, filed March 19, 2026 | Information Security Officer | not identified | full board |
| Sunrise Realty Trust, Inc.FY 2025, filed March 12, 2026 | not identified | not identified | Audit and Valuation Committee |
| ACRES Commercial Realty Corp.FY 2025, filed March 10, 2026 | not identified | not identified | audit committee |
| Franklin Street Properties CorpFY 2025, filed March 9, 2026 | Vice President and Director of Information Technology | not identified | Audit Committee |
| RLJ Lodging TrustFY 2025, filed February 27, 2026 | not identified | not identified | Audit Committee |
| NexPoint Residential Trust, Inc.FY 2025, filed February 26, 2026 | Director of Information Technology | not identified | Audit Committee |
| FrontView REIT, Inc.FY 2025, filed February 25, 2026 | IT Manager | Chief Operating Officer | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Medical Properties Trust Inc's Form 10-K as filed with the SEC on February 26, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. Cybersecurity
Cyber Risk Management and Strategy
We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following:
•
implementing the latest software releases and tools (including multi-factor authentication) in a timely manner;
•
seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers (and given we are a commercial real estate landlord, we do not maintain credit card or patient information in our systems);
•
seek to restrict information system access to appropriate levels while allowing users to fulfill their business responsibilities;
•
constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats;
•
third party internal and external vulnerability assessments and penetration testing;
•
annual review and audit of cyber controls and procedures;
•
periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology;
•
periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties;
•
security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements;
•
employee anti-phishing campaigns performed at least quarterly;
•
a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and
•
a cybersecurity risk insurance policy.
We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us , including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.
Cyber Governance
Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board of Directors and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board of Directors, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.
The Board of Directors receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.
Led by our Head of Technology with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board of Directors and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 3, 2025 sec.gov ↗
Top security role, as the filing names it
Director of Information Technology and Security
Reports to, as the filing names it
not identified
Board oversight
Risk Committee
“However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“Led by our Director of Information Technology and Security ("Director of IT") with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts.”
Material incident
The filing states none
“We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us , including our overall business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 27, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
Cyber Risk Management and Strategy
We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following:
•
implementing the latest software releases and tools (including multi-factor authentication) in a timely manner;
•
seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers;
•
constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats;
•
third party internal and external vulnerability assessments and penetration testing;
•
annual review and audit of cyber controls and procedures;
•
periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology;
•
periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties;
•
security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements;
•
employee anti-phishing campaigns performed at least quarterly;
•
a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and
•
a cybersecurity risk insurance policy.
We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us , including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.
Cyber Governance
Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.
The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.
Led by our Director of Information Technology and Security ("Director of IT") with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.
Fiscal 2023 Form 10-K, filed February 29, 2024 sec.gov ↗
Top security role, as the filing names it
Director of Information Technology and Security
Reports to, as the filing names it
not identified
Board oversight
Risk Committee
“However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“Led by our Director of Information Technology and Security ("Director of IT") with over 40 years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts.”
Material incident
The filing states none
“We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 27, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
Cyber Risk Management and Strategy
We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following:
•
implementing the latest software releases and tools (including multi-factor authentication) in a timely manner;
•
seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers;
•
constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats;
•
third party internal and external vulnerability assessments and penetration testing;
•
annual review and audit of cyber controls and procedures;
•
periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology;
•
periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties;
•
security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements;
•
employee anti-phishing campaigns performed at least quarterly;
•
a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and
•
a cybersecurity risk insurance policy.
We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.
Cyber Governance
Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.
The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.
Led by our Director of Information Technology and Security ("Director of IT") with over 40 years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.