The RMR Group (26R) Risk Analysis

Our Board of Directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. Our Audit Committee takes a leading role in oversight of risk management, including risks related to cybersecurity, and receives reports from our management regarding cybersecurity risks and countermeasures being undertaken or considered by us, including updates on the internal and external cybersecurity landscape and relevant technical developments and more frequent reports as it may direct or as warranted. Our cybersecurity program is led by our Chief Information Officer, or CIO, who has over two decades of relevant experience in information technology and cybersecurity and has primary responsibility for assessing and managing material risks from cybersecurity threats and overseeing our cybersecurity team. Our CIO has previously held senior information technology and security roles, including as CIO of a global real estate firm and of a real estate investment trust. Our Director of Information Security and our cybersecurity team are responsible for, among other things, information technology failure mitigation and business continuity, cybersecurity threat detection and incident response and continuous network monitoring. Our cybersecurity team members have a broad array of relevant skills and expertise and have obtained, or are working to obtain, relevant information security certifications, including Certified Information Systems Security Professional, Certified Information Systems Auditor and Certified Risk and Information Systems Control certifications. Our Director of Information Security assembles our incident response and investigative teams and informs our CIO if an incident occurs. Investigative findings are reported to our executive leadership and to the relevant Our Board of Directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. Our Audit Committee takes a leading role in oversight of risk management, including risks related to cybersecurity, and receives reports from our management regarding cybersecurity risks and countermeasures being undertaken or considered by us, including updates on the internal and external cybersecurity landscape and relevant technical developments and more frequent reports as it may direct or as warranted. Our cybersecurity program is led by our Chief Information Officer, or CIO, who has over two decades of relevant experience in information technology and cybersecurity and has primary responsibility for assessing and managing material risks from cybersecurity threats and overseeing our cybersecurity team. Our CIO has previously held senior information technology and security roles, including as CIO of a global real estate firm and of a real estate investment trust. Our Director of Information Security and our cybersecurity team are responsible for, among other things, information technology failure mitigation and business continuity, cybersecurity threat detection and incident response and continuous network monitoring. Our cybersecurity team members have a broad array of relevant skills and expertise and have obtained, or are working to obtain, relevant information security certifications, including Certified Information Systems Security Professional, Certified Information Systems Auditor and Certified Risk and Information Systems Control certifications. Our Director of Information Security assembles our incident response and investigative teams and informs our CIO if an incident occurs. Investigative findings are reported to our executive leadership and to the relevant