Company: CNS
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001284812-25-000087
Chunk: 33

Company: COHEN & STEERS, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 33
---
 on Form 10-K, including under the caption “We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures.”

Governance

Our cybersecurity risk assessment and management processes are implemented and maintained by members of our Cybersecurity Management, including our CISO, CTO and our Head of IT Infrastructure. •Our CISO oversees the information security group and program within our IT department with over 25 years of experience, including similar roles at other financial services companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99.•Our CTO oversees our IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company.•Our Head of IT Infrastructure oversees the infrastructure and service desk within our IT department and has served in various roles in information technology for over 21 years.Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy and communicating key priorities to relevant personnel. Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company’s incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.The audit committee of the board of directors actively participates in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO and CISO the Company’s cybersecurity program, including the robustness and efficacy of the overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to potential threats. The audit committee also annually reviews and discusses the ERM process and risk assessment, as well as the Company’s cyber insurance coverage. Additionally, the