Company: JLL
Filing Date: 2025-04-11
Form Type: DEF 14A
Source: 0001037976-25-000014
Chunk: 31

Company: JONES LANG LASALLE INC
Filing Date: 2025-04-11
Form: DEF 14A
Chunk 31
---
 frameworks designed to attract, retain, engage and develop a workforce that aligns with our values and organizational purpose.

The Board’s role in information and data security oversight

Our management and the Board of Directors provide significant oversight of cybersecurity risks. Since 2022, the Board expanded the Audit and Risk Committee’s Charter to include cybersecurity and information technology readiness. In addition, the Audit Committee was renamed the “Audit and Risk Committee” to more accurately align with its responsibility to assist the Board in overseeing the Company’s policies, programs and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology. Further enhancing our cybersecurity governance, in 2024, the Board formally established the Cybersecurity Subcommittee of the Audit and Risk Committee. This Subcommittee meets on a quarterly basis with management and regularly reports to the Audit and Risk Committee, providing an additional layer of specialized oversight on cybersecurity and information technology matters.

Management’s role in executing our cybersecurity strategy is led by our Global Chief Information Officer (“CIO”) and our Chief Information Security Officer (“CISO”), both with over twenty years experience in large institutions. Our cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by us, or in our care. Our cybersecurity program strategy is to implement layered controls to reduce our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events.

We maintain a robust cyber incident response plan that includes controls and procedures designed to allow timely and accurate reporting of any material cybersecurity incident. We view cybersecurity as a shared responsibility involving the entirety of our workforce. To mitigate potential risks and ensure data integrity, we employ a comprehensive, multi-pronged strategy. This strategy encompasses the periodic execution of simulations and tabletop exercises involving both management and technical personnel, the provision of mandatory annual information security training for employees with access to sensitive company or client-related data, and the consistent administration of phishing tests, supplemented by targeted educational programs. We continue to implement new controls, governance, technical protections and other procedures to mitigate against the risks of a cybersecurity event . We have experienced various types of cyber-attack incidents in the last three years, which to-date have been contained and have not been material to us. JLL also maintains a cyber risk insurance policy.

The Audit and Risk Committee, its Cybersecurity Subcommittee, and management’s Cybersecurity Governance Committee comprised of senior executives representing several core business segments receive regular reports on our information security program, including top risks, strategy, controls, improvement projects, metrics and training protocols. Reports are also shared with the full