XML 49 R34.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We maintain a cyber risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The program is integrated within our enterprise risk management system and addresses our IT networks and related systems that are essential to the operation of our business.
We maintain controls and procedures, including third-party oversight procedures, and cybersecurity training for all employees on an annual basis.
We work with third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.
Our cybersecurity program and designated incident response team are comprised of key employees, and third-party information security experts from leading cybersecurity incident response firms, who are responsible for efficiently and effectively responding to cybersecurity incidents. We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See “Risk Factors – We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We maintain a cyber risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The program is integrated within our enterprise risk management system and addresses our IT networks and related systems that are essential to the operation of our business.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Board of Directors considers cybersecurity risk as part of its risk oversight function, and the Audit Committee of our Board of Directors oversees Realty Income's cybersecurity and other information technology risk exposures and the steps taken by management to monitor and control such exposures. Our cybersecurity risk profile and cybersecurity program status are reported to the Audit Committee on a quarterly basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity, and the full Board of Directors also receives briefings from management on our cybersecurity risk management program, as appropriate.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Board of Directors considers cybersecurity risk as part of its risk oversight function, and the Audit Committee of our Board of Directors oversees Realty Income's cybersecurity and other information technology risk exposures and the steps taken by management to monitor and control such exposures. Our cybersecurity risk profile and cybersecurity program status are reported to the Audit Committee on a quarterly basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity, and the full Board of Directors also receives briefings from management on our cybersecurity risk management program, as appropriate.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our cybersecurity risk profile and cybersecurity program status are reported to the Audit Committee on a quarterly basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity, and the full Board of Directors also receives briefings from management on our cybersecurity risk management program, as appropriate.
Cybersecurity Risk Role of Management [Text Block]
Our Senior Vice President of Information Technology is primarily responsible for assessing and managing our material risks from cybersecurity threats, including our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Senior Vice President of Information Technology has served in IT roles for the Company since 2007, and has led the department since 2020. He has over 20 years of experience implementing and operating cybersecurity technologies, policies, and procedures throughout various industries.
Our Senior Vice President of Information Technology works closely with our management team to keep them informed about and to monitor the Company’s efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Senior Vice President of Information Technology is primarily responsible for assessing and managing our material risks from cybersecurity threats, including our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Senior Vice President of Information Technology has served in IT roles for the Company since 2007, and has led the department since 2020. He has over 20 years of experience implementing and operating cybersecurity technologies, policies, and procedures throughout various industries.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our cybersecurity risk profile and cybersecurity program status are reported to the Audit Committee on a quarterly basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity, and the full Board of Directors also receives briefings from management on our cybersecurity risk management program, as appropriate.
Our Senior Vice President of Information Technology works closely with our management team to keep them informed about and to monitor the Company’s efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true