8 unchanged sentences
Blackstone utilizes a variety of protective measures as a part of its cybersecurity program.
−Removed: These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.
+Added: These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.
Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities.
1 unchanged sentence
Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks , such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines.
−Removed: Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes.
+Added: Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes.
Blackstone’s Chief Security Officer, or CSO, and members of Blackstone’s senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises.
−Removed: Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate.
+Added: Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate.
In addition to Blackstone’s internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets.
4 unchanged sentences
The IRP is reviewed at least annually.
−Removed: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm’s overall risk management practices described above.
+Added: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm’s overall risk management practices described above.
Blackstone’s CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.
2 unchanged sentences
On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks.
−Removed: In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors’ cybersecurity programs and practices.
+Added: In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors’ cybersecurity programs and practices.
Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.
For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see “Part 1.
−Removed: Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to
−Removed: regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations ” in this Annual Report on Form 10-K.
+Added: Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage
+Added: to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations ” in this Annual Report on Form 10-K.
Cybersecurity Governance
−Removed: Blackstone has a dedicated cybersecurity team, led by Blackstone’s CSO, who works closely with Blackstone senior management, including Blackstone’s Chief Technology Officer, or CTO, to develop and advance the firm’s cybersecurity strategy, which applies to us.
+Added: Blackstone has a dedicated cybersecurity team, led by Blackstone’s CSO, who works closely with Blackstone senior management, including Blackstone’s Chief Technology Officer, or CTO, to develop and advance the firm’s cybersecurity program strategy, which applies to us.
Blackstone’s CSO and CTO have extensive experience in cybersecurity and technology, respectively.
−Removed: Blackstone’s CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone.
−Removed: Prior to his appointment as CSO in 2017, Mr.
−Removed: Fletcher was Blackstone’s Deputy CSO.
−Removed: Before joining Blackstone in 2014, Mr.
−Removed: Fletcher led the International Security organization for Equifax from 2012 to 2014.
−Removed: Blackstone’s CTO, John Stecher is a Senior Managing Director and head of BXTI.
−Removed: Stecher is responsible for all aspects of technology across Blackstone.
−Removed: Stecher also advises Blackstone’s investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters.
−Removed: Before joining Blackstone in 2020, Mr.
−Removed: Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays.
−Removed: He was also a member of the Barclays Technology Management Committee.
−Removed: Prior to joining Barclays in 2017, Mr.
−Removed: Stecher held a variety of senior management and engineering roles across Goldman Sachs’ capital markets and technology divisions.
+Added: Blackstone’s CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone.
+Added: He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.
+Added: Blackstone’s CTO is a Senior Managing Director and the head of BXTI.
+Added: Our CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution.
+Added: Our CTO is responsible for all aspects of technology across Blackstone, advises Blackstone’s investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters.
BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks.
−Removed: The CSO and CTO review Blackstone’s cybersecurity framework annually as well as on an event-driven basis as necessary.
+Added: The CSO and CTO are responsible for the review of Blackstone’s cybersecurity framework annually as well as on an event-driven basis as necessary.
The CSO and CTO also review the scope of Blackstone’s cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone’s information and systems.
4 unchanged sentences
Our principal executive and administrative offices are located in leased space at 345 Park Avenue, 24th Floor, New York, New York 10154.
−Removed: As of December 31, 2023, we did not own any real property.
We consider these facilities to be suitable and adequate for the management and operations of our business.
+Added: For an overview of our real estate investments, see Note 4 to our consolidated financial statements.
LEGAL PROCEEDINGS
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.