Disclosure · Form 10-K · fiscal 2025
FrontView REIT, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 25, 2026· period ended December 31, 2025· FVR· CIK 1988494· Updated · filing on sec.gov ↗
FrontView REIT, Inc.'s Form 10-K for fiscal 2025, filed February 25, 2026, names the IT Manager as its top security role, reporting to the Chief Operating Officer, with oversight by the audit committee.
What FrontView REIT's Item 1C says
FrontView REIT's Form 10-K for fiscal 2025 places oversight of cybersecurity risk management processes with the audit committee, to which the board of directors has delegated responsibility. Cybersecurity risk assessment and management processes are overseen by the Chief Operating Officer and the IT Manager.
Board and management oversight
The audit committee reviews the processes that management has developed to assess, monitor, manage, and mitigate risks from cybersecurity threats to the company. The audit committee will review cybersecurity processes and threats and will brief the entire board of directors on them, in each case on at least an annual basis. The outsourced IT team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into overall risk management strategy, and communicating key priorities to relevant personnel.
Who leads security
Information security processes are overseen by an outsourced IT Manager, with oversight from the Chief Operating Officer. The IT Manager has worked in various roles responsible for securing networks, hardware, and other application systems.
How the company manages cyber risk
The company has implemented technical, physical, and organizational measures covering incident response, network security controls, access controls, periodic back-ups of data, and employee training on cybersecurity awareness. The company's assessment and management of material risks from cybersecurity threats are integrated into its overall risk management processes. The company designates a group of employees as a cybersecurity incident response team, which includes the Chief Financial Officer. Incident response processes are designed to escalate cybersecurity incidents to members of management, including senior management, depending on the circumstances.
Third parties and incidents
The company relies on third-party service providers to assist with employee phishing testing and cybersecurity awareness training. The company has implemented a risk-based approach designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers. Depending on the services, data sensitivity and provider identity, the third-party service provider risk management process involves different levels of assessment and imposes contractual obligations related to cybersecurity on the provider. The incident response process requires reporting to the audit committee about certain cybersecurity incidents. As of the date of the report, the company has not identified cybersecurity risks that have materially affected it or are reasonably likely to affect it.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed February 25, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
IT Manager
Reports to
Chief Operating Officer
“Our information security processes are overseen by an outsourced IT Manager, with oversight from our Chief Operating Officer, who works to help identify, assess, and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using various methods.”
Board oversight
audit committee
“Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware , and other application systems.”
Material incident
The filing states none
“As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition.”
The section
728 words, Form 10-K filed February 25, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns FrontView REIT, Inc. standard industrial classification 6798, Real estate investment trusts (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Ashford Hospitality Trust IncFY 2025, filed March 23, 2026 | Executive Vice President of Technology | Executive Vice President of Asset Management | Audit Committee |
| Strawberry Fields REIT, Inc.FY 2025, filed March 19, 2026 | Information Security Officer | not identified | full board |
| Sunrise Realty Trust, Inc.FY 2025, filed March 12, 2026 | not identified | not identified | Audit and Valuation Committee |
| ACRES Commercial Realty Corp.FY 2025, filed March 10, 2026 | not identified | not identified | audit committee |
| Franklin Street Properties CorpFY 2025, filed March 9, 2026 | Vice President and Director of Information Technology | not identified | Audit Committee |
| RLJ Lodging TrustFY 2025, filed February 27, 2026 | not identified | not identified | Audit Committee |
| Medical Properties Trust IncFY 2025, filed February 26, 2026 | Head of Technology | not identified | Risk Committee |
| NexPoint Residential Trust, Inc.FY 2025, filed February 26, 2026 | Director of Information Technology | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of FrontView REIT, Inc.'s Form 10-K as filed with the SEC on February 25, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Risk Management and Strategy
Cybersecurity Processes
We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including sensitive and confidential information (including intellectual property and tenant and property-related information) that is proprietary, strategic, or competitive in nature ("Information Systems and Data"). Our information security processes are overseen by an outsourced IT Manager, with oversight from our Chief Operating Officer, who works to help identify, assess, and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using various methods. We have implemented and maintain technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including with respect to incident response, network security controls, access controls, periodic back-ups of data, and employee training addressing awareness of cybersecurity risks and how to detect certain cyberattacks. Some of these measures and processes involve the assistance of additional third-party service providers. For example, we rely on third-party service providers to assist us with our employee phishing testing and cybersecurity awareness training.
Risk Assessment
Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's overall risk management processes include an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).
Third Party Risk Management
We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented a risk-based approach designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers , including an assessment of the security protocols of certain service provider s. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our third-party service provider risk management process involves different levels of assessment designed to identify cybersecurity risks associated with the provider and imposes contractual obligations related to cybersecurity on the provider.
Cyber Threats
As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that we face, see our risk factors under Part 1. Item 1A. Risks Related to our Business and Properties - Security breaches and other technology disruptions could disrupt our operations, compromise our confidential information or information systems and expose us to liability, which could materially and adversely affect us.
Governance
Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee reviews the processes developed by management to assess, monitor, manage, and mitigate risks from cybersecurity threats to the Company. The audit committee will review our cybersecurity processes and cybersecurity threats, and will brief the entire board of directors on these processes and threats, in each case on at least an annual basis.
Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware , and other application systems. Our outsourced IT team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.
Our cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated a group of Company employees as members of a cybersecurity incident response team, which includes the Chief Financial Officer. This team is intended to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process also requires reporting to the audit committee about certain cybersecurity incidents.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 20, 2025 sec.gov ↗
Top security role, as the filing names it
IT Manager
Reports to, as the filing names it
not identified
Board oversight
audit committee
“Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware , and other application systems.”
Material incident
The filing states none
“As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Risk Management and Strategy
Cybersecurity Processes
We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including sensitive and confidential information (including intellectual property and tenant and property-related information) that is proprietary, strategic, or competitive in nature ("Information Systems and Data"). Our information security processes are overseen by an outsourced IT Manager, with oversight from our Chief Operating Officer, who works to help identify, assess, and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using various methods. We have implemented and maintain technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including with respect to incident response, network security controls, access controls, periodic back-ups of data, and employee training addressing awareness of cybersecurity risks and how to detect certain cyberattacks. Some of these measures and processes involve the assistance of additional third-party service providers. For example, we rely on third-party service providers to assist us with our employee phishing testing and cybersecurity awareness training.
Risk Assessment
Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's overall risk management processes include an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).
Third Party Risk Management
We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented a risk-based approach designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers , including an assessment of the security protocols of certain service provider s. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our third-party service provider risk management process involves different levels of assessment designed to identify cybersecurity risks associated with the provider and imposes contractual obligations related to cybersecurity on the provider.
Cyber Threats
As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that we face, see our risk factors under Part 1. Item 1A. Risks Related to our Business and Properties - Security breaches and other technology disruptions could disrupt our operations, compromise our confidential information or information systems and expose us to liability, which could materially and adversely affect us.
Governance
Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee reviews the processes developed by management to assess, monitor, manage, and mitigate risks from cybersecurity threats to the Company. The audit committee will review our cybersecurity processes and cybersecurity threats, and will brief the entire board of directors on these processes and threats, in each case on at least an annual basis.
Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware , and other application systems. Our outsourced IT team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.
Our cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated a group of Company employees as members of a cybersecurity incident response team, which includes the Chief Financial Officer. This team is intended to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process also requires reporting to the audit committee about certain cybersecurity incidents.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.