CHIMERA INVESTMENT CORP

Risk Management and Strategy

We have a risk management process and strategy in place for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management framework is closely aligned with the National Institute of Standards and Technology’s (“NIST”) Cybersecurity Framework (“CSF”) and is incorporated into our enterprise risk management process, information systems, vendor engagement process and employee training programs. We focus on people, processes and technology to build a defensive posture against cybersecurity threats that minimizes disruption to our business while maximizing the security and resiliency of the organization.

We believe that one of the first lines of defense against cybersecurity threats is our employees. Accordingly, we require all new employees to complete cybersecurity training. In addition, we provide quarterly cybersecurity training to existing employees, conduct simulated phishing tests, and perform security awareness proficiency assessments to create more effective and targeted training campaigns to strengthen the human firewall. We also require our employees to annually re-affirm adherence to company-wide IT and related policies designed to protect our information and communications systems. As part of our cybersecurity risk management process, we also conduct third-party led tabletop exercises to practice and prepare to respond to a confirmed or suspected security incident and to highlight any areas for potential improvement.

Our cybersecurity vendors are increasingly incorporating artificial intelligence and machine learning technologies into their products to enhance threat detection, prevention, and response capabilities. These technologies are designed to analyze large volumes of data, identify anomalous behavior, and detect potential threats that may not be identifiable through signature-based or rules-based approaches alone. While AI-enabled tools may improve the speed and effectiveness of threat identification and response, their effectiveness depends on the quality of underlying data, model tuning, and ongoing oversight, and such tools may not prevent all cybersecurity incidents. We utilize AI-enabled security capabilities as part of our broader, layered cybersecurity program, in combination with human review and established controls.

We also maintain policies, procedures and governance structures designed to help us identify, assess and respond to cybersecurity risks. We have a written cybersecurity framework that closely aligns with the NIST’s CSF. In addition, we maintain a cyber incident response plan to facilitate our response to cybersecurity incidents and formed an Incident Response Team composed of the Chief Information Security Officer & Head of IT Infrastructure (“CISO”), the Head of Portfolio Analytics, the Chief Legal Officer, the Head of Operations, the Chief Compliance Officer of Advisory Services, the Head of Data Science, the Associate General Counsel, and certain senior IT officers of HomeXpress. The foregoing officers also include within their working teams, non-management employees who are best positioned to identify, assess, respond to and galvanize both internal and third-party resources necessary in the event of a cybersecurity incident. We test the resiliency of our systems through penetration and disaster recovery tests to continually improve our business continuity plans against an ever-changing threat landscape, create redundancies where appropriate for the protection of the Company’s assets, have engaged a security operations center to provide 24/7 monitoring of our environment to detect and respond to suspicious activities in the network, and have cybersecurity insurance. We periodically perform an independent third-party cybersecurity maturity assessment of our systems, policies and procedures focused on the NIST’s CSF and the SEC’s Office of Compliance Inspections and Examinations cybersecurity guidance.

We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements. We collaborate with service providers to help assess the sufficiency of their cybersecurity measures and require service providers to notify us promptly of cyber incidents that may affect our systems or data.

Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities and promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.

We have completed the integration of the Palisades IT assets into our established cybersecurity programs and information technology general controls. In October 2025, we completed the acquisition of HomeXpress and have initiated the process of integrating its cybersecurity function into our governance framework. This integration includes incorporating legacy HomeXpress personnel into our Incident Response Team. We are conducting comprehensive cybersecurity risk assessments to identify and prioritize remediation efforts and to align HomeXpress’ cybersecurity programs and IT general controls with our existing practices.

To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge, are reasonably likely to materially affect us including our business strategy, results of operations or financial condition. For further discussion, please see the risk factor titled “We are dependent on information technology and systems, including those of third parties, and their failure, including through a cyber-attack, could significantly disrupt our business or result in the disclosure or misuse of confidential or other information, including personal information, which could damage our reputation, result in regulatory sanctions, subject us to litigation and/or increase our costs and cause losses that have a material adverse impact on our business, financial results and financial condition” in Item 1A. “Risk Factors” in this Annual Report on Form 10-K.

Governance

Our Board of Directors, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our CISO on, among other things, the threat landscape, the Company’s cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company’s overall business risk profile. Refer to Item 7A, “Quantitative or Qualitative Disclosures about Market Risk - Risk Management” included in this 2025 Form 10-K for additional information on our enterprise risk management.

The Company’s CISO has a Bachelor of Engineering degree in information technology and more than 28 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team also elevate any potential cybersecurity issues, whether internal or at a third party with whom we do business, to the CISO.

The Incident Response Team and the non-management employees who support the Incident Response Team identify, assess, respond to and coordinate both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified, and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation and regulatory and other government authorities as applicable and as required by law.

As of December 31, 2025, we do not own any property. Our corporate headquarters is located in leased space at 630 Fifth Avenue, Ste 2400, New York, New York 10111, telephone (212) 626-2300. Our office lease expires in January 2027. We believe that this space is suitable and adequate for our current needs. In addition, we have leases through November 2026, for our off-site back-up facilities and data centers located in Wappingers Falls, New York and Norwalk, Connecticut.

As a result of the Palisades acquisition in December 2024, we acquired leases on spaces located at 6001 Bold Ruler Way, Suite 110, Austin, Texas 78746, which runs through December 2026, 401 South 1st Street, Suite 850, Austin, Texas 78704, which runs through March 2035, and 909 Davis Street, Ste 500, Evanston, Illinois 60201, which runs through August 2029.

As a result of the HomeXpress Acquisition, we have acquired leases for HomeXpress’ two primary facilities located in 1936 E Deere Ave, Suite 200, Santa Ana, California 92705, and 4902 Eisenhower Blvd, Suite 155, Tampa, Florida , 33634. HomeXpress’ corporate office is in Santa Ana, California. In 2025, HomeXpress renewed its Santa Ana, California lease and extended it to September 2027. HomeXpress’ lease for Tampa, Florida is active through August 2029.

Our Investment Portfolio segment utilizes the New York City, Wappingers Falls, Norwalk, Austin, and Evanston offices and facilities. Our Residential Origination segment utilizes the Santa Ana and Tampa offices.