Company: LAZ
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001628280-25-007441
Chunk: 146

Company: Lazard, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 146
---
Item 1C.    Cybersecurity 

Our business is highly dependent on electronic information resources used for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our and our clients’ information, which we refer to as “information systems”, including our computer systems, hardware, software and networks and those of our third-party vendors and service providers. Our operations rely on the secure processing, storage and transmission of confidential and other information by our information systems and those of third parties.Lazard maintains a formal, robust cybersecurity and information security program that is aligned with the National Institute of Standards and Technology Cybersecurity Framework (“CSF”) and integrated into our overall risk management process. Our Information Security Program, Policies and Standards are also designed to comply with the financial regulations and cybersecurity laws in the jurisdictions in which we operate. By focusing on the following four interconnected pillars, we aim to reduce the impact of cybersecurity incidents, safeguard our digital assets and foster a proactive and comprehensive approach to cybersecurity within our organization.•Risk assessments and mitigation strategies◦Conduct regular risk assessments to identify and prioritize critical assets and vulnerabilities, both internally and with respect to third-party risks.◦Develop and implement appropriate mitigation strategies based on risk assessments.◦Monitor and evaluate the effectiveness of risk mitigation measures.•Professional cybersecurity staff◦Retain and recruit skilled cybersecurity professionals.◦Provide regular training and development opportunities.◦Foster collaboration and knowledge sharing among cybersecurity team members.•Security-aware organizational culture◦Maintain policies and procedures for reporting and responding to cybersecurity incidents.◦Empower employees to take ownership of their cybersecurity responsibilities.◦Promote a security-aware culture throughout the organization through regular training and awareness programs.•Security technology ◦Implement and maintain robust cybersecurity technologies, including advanced threat detection, prevention and response tools.◦Regularly evaluate and update our suite of cybersecurity technology to address emerging threats and vulnerabilities. ◦Integrate cybersecurity technologies with other systems and processes.

Third-Party Monitoring and External Reviews

As noted above, our business regularly uses and relies on third-party information systems and services to process, store and transmit confidential and other information. To support our cybersecurity oversight of third-party information technology providers, we have integrated automated processes to manage third-party cloud security. We also use an enterprise-wide third-party technology provider to assist in our identification and assessment of cybersecurity risks to the Company presented by third parties, and our contracts are vetted by our internal legal and compliance departments as part of a process designed to ensure that we are provided the right to