Company: MGRE
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001004434-25-000010
Chunk: 13

Company: AFFILIATED MANAGERS GROUP, INC.
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 13
---
Item 1C.Cybersecurity

Risk Management and Strategy

Our cybersecurity risk management program is integrated into our overall risk management framework.  We regularly 

assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices.  To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information regarding our Affiliates and their clients, and have adopted policies, management oversight, accountability structures, and technology processes designed to safeguard this information.  All of our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the AMG data and systems to which they have access.  These trainings also instruct employees on how to report any potential privacy or data security issues. Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors.  We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data.  Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards.  We monitor industry best practices and developments in data privacy and security and have increased scrutiny of third-party service providers with access to sensitive AMG data, including through security risk assessments at the time of initial contract, periodically as part of our third-party risk management process, and upon detection of an increase in the vendor’s risk profile.  In addition, we require key providers to meet appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party providers, as appropriate.  We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach.  We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place designed to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster. Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we