Company: LAZ
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001628280-25-007441
Chunk: 148

Company: Lazard, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 148
---
, including cybersecurity risks, as well as the likelihood of the occurrence of cybersecurity risks, the potential impact of those risks and the steps management has taken to monitor, mitigate and control such risks. In addition, our CISO reports at least annually to the Board, and at least quarterly to the Board’s Audit Committee, with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of Lazard’s cybersecurity program. Updates on cybersecurity risks are reviewed at regular meetings of the Audit Committee and reported to the full Board.  

Incident Response and Assessment Policies and Procedures

Lazard has implemented policies and procedures to protect the firm from any interruptions to the availability of our data and our systems and to protect the firm’s and our clients’ data from intentional and unintentional disclosure, including disclosure arising from a range of cybersecurity threats. These policies and procedures outline actions to be taken after identifying suspected cybersecurity threats and cybersecurity incidents and designate the persons responsible for managing those actions. 

Our disclosure controls and procedures provide for the CSIHT to report high severity cybersecurity incidents to an Assessment Committee, consisting of our CFO, CISO and General Counsel, among others, for an assessment of materiality. The Assessment Committee in consultation with third-party experts, as warranted, makes the incident materiality determination consistent with SEC guidance.

A determination that a cybersecurity incident has, or is reasonably likely to have, a material impact on the Company is reported by the Assessment Committee to the CEO and the Board’s Audit Committee without delay.  The Assessment Committee also provides a summary of all incidents that are determined to be immaterial to the Board’s Audit Committee at the next scheduled meeting.

For additional information regarding how cybersecurity threats or incidents are reasonably likely to materially affect our business strategy, results of operations or financial condition, see “Risk Factors—A failure in or breach of our information systems or infrastructure, or those of third parties with which we do business, including as a result of cybersecurity incidents or threats, could disrupt our businesses, lead to reputational harm and legal liability or otherwise 

35

impact our ability to operate our business” and “Risk Factors—Other operational risks may disrupt our businesses, result in regulatory action against us or limit our growth.”