Company: TROW
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001113169-25-000007
Chunk: 88

Company: PRICE T ROWE GROUP INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 88
---
 firm's risk mitigation strategies. Assessments include third-party validation to help ensure our internal controls and safeguards adhere to security and compliance standards. We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting, System and Organization Controls (SOC) 1, and SOC 2 for key operational Business Units. In addition, we periodically engage with third-party partners to perform an independent evaluation of our cybersecurity program as well as external network penetration testing. This complements our internal assessments, such as application security testing, vulnerability management, and penetration testing. The firm participates in various industry threat intelligence information sharing forums to stay current on evolving cyber risks and threats. The results of these assessments are discussed with and reviewed by the Audit Committee, and shared with the Board, annually.

Within the firm's global risk department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds. The Supplier Risk Management program performs regular assessments, including information security reviews. Ongoing monitoring is performed through our centralized risk function as well as by business line supplier managers to raise new threats or weaknesses associated with a third-party service. In accordance with our Enterprise Incident Management Policy, any third-party cybersecurity incident is reported and evaluated for further review and impact analysis. 

We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication. Although no cybersecurity incident during the year ended December 31, 2024, resulted in an interruption of our operations, known losses of critical data, nor a material impact on the firm’s strategy, financial condition or results of operations. The scope and impact of any future incident cannot be predicted. See “Item 1A. Risk Factors–Technology Risks” for more information on how a material cybersecurity incident may impact us.