Company: MGRE
Filing Date: 2025-04-11
Form Type: DEF 14A
Source: 0001004434-25-000021
Chunk: 30

Company: AFFILIATED MANAGERS GROUP, INC.
Filing Date: 2025-04-11
Form: DEF 14A
Chunk 30
---
 named executive officers resulted in donations under this program to not-for-profit organizations in the following amounts: Mr. Horgen, $250,000; Mr. Wojcik, $150,000; and Ms. Padiyar, $150,000. To learn more, please see www.amg.com/responsibility

23

Cybersecurity and Data Privacy : We have a formal information security program, designed to develop and maintain privacy

and data security practices to protect AMG assets and sensitive third-party information, including personal and Affiliate information.

This program is governed by a committee comprising members of senior management, including the Company’s Chief Information

Officer, which meets regularly and reports to the Board of Directors at least annually (the “Information Security Governance

Committee”). Members of the Information Security Governance Committee oversee communications with the Board of Directors

regarding material cybersecurity incidents and provide the Board of Directors with a summary of any risks from current

cybersecurity threats on a regular basis, as well as updates on management’s information security program oversight and

maintenance activities, and any material changes to AMG’s information security practices and procedures. The Board is also

regularly provided with cybersecurity educational sessions, including perspectives from external advisors invited to present on

current cybersecurity topics.

We recognize the importance of protecting information assets such as the personally identifiable information of our employees,

and proprietary business information regarding our Affiliates and their clients, and have adopted policies, management oversight

and accountability structures, and technology processes designed to safeguard this information. All of our employees are required

to attest annually to our information security policies and participate in regular security awareness training to protect their

information and the AMG data and systems to which they have access. These trainings also instruct employees on how to report

any potential privacy or data security issues.

Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate,

resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to

address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are

performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and

safeguards. We monitor industry best practices and developments in data privacy and security and have increased scrutiny of

third-party service providers with access to sensitive AMG data, including through security risk assessments at the time of initial

contract, periodically as part of our third