Company: LAZ
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001628280-25-007441
Chunk: 147

Company: Lazard, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 147
---
 audit and test the security and quality of each of our vendors. As part of our screening and evaluation processes, we conduct due diligence on our potential vendors, as well as regular assessments of current vendors, regarding compliance with law (including financial regulations, sanctions regimes and data privacy regulations) and cybersecurity standards, including background checks and system tests.  

34

Our Chief Information Security Officer (“CISO”) regularly engages independent third parties to assess the performance of our cybersecurity risk management systems and procedures and to help test and identify cybersecurity risks to the Company. Annually, we engage an independent third-party to perform a comprehensive review of our cybersecurity programs, with the aim of ensuring alignment with the current version of the CSF. In addition, we engage several other third parties at regular intervals for targeted assessments of specific cybersecurity risk management systems, tools, vendors and processes. Among other things, tests include simulations of communications shared with affected stakeholders on security events and identification of vulnerabilities. These third-party audits and assessments are used by management to review, update and improve our cybersecurity risk management systems and identify vulnerabilities. Results and recommendations are reported to our CISO, who reports to our General Counsel. Material findings are presented to the Global Risk Committee (“GRC”), Audit Committee and the full Board as discussed below. 

Cybersecurity Management Team and Board Oversight 

Lazard’s cybersecurity program, which includes information security, is the primary responsibility of our CISO, who oversees our global information security strategy and program and is supported by our Information Technology and Information Security departments. The Company’s current CISO has held the position since 2015 and has been working in technology risk management since 1991. The CISO holds a bachelor’s degree from New York Institute of Technology and is an accredited Certified Information Systems Security Professional. Our CISO leads our Cybersecurity Incident Handling Team (“CSIHT”), to which cybersecurity threats and cybersecurity incidents are reported. The CSIHT manages the Company’s response to cybersecurity threats and cybersecurity incidents, including the prevention, detection, analysis, containment, eradication and recovery thereof. The CISO reports monthly to the GRC, which includes our Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”) and General Counsel, among other members of senior management, regarding cybersecurity incidents from the preceding month.

Our Internal Audit department regularly assesses and reports to the Audit Committee on the effectiveness of our cybersecurity and information technology controls. Our Audit Committee reviews the Company’s cybersecurity risk profile and risk management strategies at regular intervals. Management reviews with the Audit Committee categories of risk the Company faces