Company: CNS
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001284812-25-000087
Chunk: 31

Company: COHEN & STEERS, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 31
---
Item 1C. Cybersecurity 

Risk Management and Strategy 

Cybersecurity is a crucial component of our enterprise risk management program. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments.Our cybersecurity risk management function is led by our Cybersecurity Management team which is comprised of our Chief Information Security Officer (CISO), Chief Technology Officer (CTO), members of our Information Technology (IT) department, as well as members of our Legal and Compliance Departments. Our Cybersecurity Management team is primarily responsible for developing, implementing and monitoring our cybersecurity program and reporting on cybersecurity matters to senior management as well as our board of directors. Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring our threat environment and the Company’s enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of the Company’s IT environment; (iv) evaluating our and our industry’s risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments. We implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, but not limited to:•technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Company personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and•organizational safeguards: (i) incident response plans that address our response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing the Company’s cybersecurity program;