Company: APO
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001858681-25-000034
Chunk: 491

Company: Apollo Global Management, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 491
---
ITEM 1C.    CYBERSECURITY

AGM’s board of directors is involved in overseeing the Company’s risk management program, including with respect to cybersecurity, which is a critical component of the Company’s overall approach to enterprise risk management (“ERM”). For additional information about our risk management framework, see “Part II—Item 7A. Quantitative and Qualitative Disclosures About Market Risk—Risk Management Framework.” Our cybersecurity policies and practices are fully integrated into our ERM framework through our reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

59

Table of Contents

As one of the critical elements of the Company’s overall ERM approach, the Company’s cybersecurity program is focused on the following key areas:•Governance. As discussed further under the heading “Cybersecurity Governance”, our board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM’s risks, including our cybersecurity risks. AGM’s Chief Information Security Officer (“CISO”) and AHL’s CISO, with support from the broader Technology team, are responsible for information security strategy, policies and practices.•Collaborative Approach. The Company utilizes a cross-functional approach involving stakeholders across multiple departments, including Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.•Technical Safeguards. The Company deploys technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence.•Incident Response and Recovery Planning. The Company has established and maintains incident response and recovery plans that address the Company’s response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.•Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.•Education