UNRESOLVED STAFF COMMENTS
−Removed: On April 28, 2023, we received a comment letter from the staff (the “Staff”) of the SEC’s Division of Corporation Finance related to our Annual Report on Form 10-K for the fiscal year ended December 31, 2022.
−Removed: Following our written response to the Staff, we received an additional letter on June 6, 2023.
−Removed: In this follow-up letter, the Staff requested additional information related to our non-GAAP measure "Fee revenue" and the appropriateness of components of "Gross contract costs," our deduction from Revenue to calculate Fee revenue.
−Removed: Subsequent to the June 6, 2023 letter, we had telephonic conversations with the Staff and provided additional written responses.
−Removed: On February 15, 2024, we received an additional letter from the Staff informing us of their objection to our “Fee revenue” and “Fee-based operating expenses” non-GAAP measures, citing questions 100.04 and 100.01 of the SEC Staff’s non-GAAP Compliance & Disclosure Interpretations as it relates to our historical non-GAAP adjustment of Gross contract costs.
−Removed: As such, effective with our first-quarter 2024 reporting cycle, we will remove all references to both measures.
−Removed: We are currently reviewing options for revised presentation of our non-GAAP disclosures.
CYBERSECURITY
−Removed: To respond to the threat of security breaches and cyberattacks, we have developed a cybersecurity program, the implementation of which is led by our Global Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”).
−Removed: Our cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by us, or in our care.
−Removed: The Audit and Risk Committee of our Board of Directors has oversight of cybersecurity per its charter and as disclosed in our proxy statement.
−Removed: In addition, cybersecurity is reviewed as part of our overall enterprise risk management program, led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit & Risk Committee of our Board of Directors.
−Removed: Our Director of Enterprise Risk Management regularly meets with our CISO and CIO to assess our cybersecurity risks, cybersecurity program mitigants and status of control improvement projects.
+Added: Our cybersecurity program, led by our Global Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”), is designed to protect and preserve the confidentiality, integrity and availability of all information and systems owned by us or in our care.
+Added: The Audit and Risk Committee of our Board of Directors oversees cybersecurity, as outlined in its charter and disclosed in our proxy statement.
+Added: In addition, cybersecurity is reviewed as part of our enterprise risk management program led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit and Risk Committee of our Board of Directors.
+Added: Our cybersecurity strategy implements layered controls aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework to minimize both the likelihood and potential impact of cybersecurity events.
+Added: Our CISO, who holds advanced qualifications and has extensive experience in cybersecurity, leads a global team of cybersecurity professionals.
+Added: Our CISO reports to our CIO who is responsible for the Company's technology, data and information management strategy, and brings over two decades of relevant experience to the role.
+Added: We engage third-party consultants for assessing, identifying and managing material cybersecurity risks, including those associated with certain third-party providers.
+Added: We maintain a cyber incident response plan and regularly conduct simulations and tabletop exercises.
+Added: In 2023, we established an executive management group responsible for determining the materiality of cybersecurity incidents and necessary disclosures.
+Added: This group consists of our CISO, Chief Financial Officer, Chief Legal Officer and Chief Accounting Officer.
Like other companies with a large technology footprint and high-profile client base, we are regularly subject to cyberattacks.
−Removed: While certain attacks have been successful, thus far none have had a material impact to our operations or clients.
−Removed: In the future, it is possible such attacks could be successful and have a material impact on our operations or our clients’ operations.
−Removed: Our cybersecurity program strategy is to implement layered controls to reduce our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events.
−Removed: These controls are aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework.
−Removed: Our CISO leads our cybersecurity program, holds a master's degree in computer and network forensics and has over twenty years of relevant experience, including cybersecurity and enterprise security leadership roles for large global organizations and within the U.S.
−Removed: Our CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military.
−Removed: Table of Conte nts
−Removed: Our CISO reports to our CIO who is responsible for the development and implementation of our technology, data and information management strategy.
−Removed: Our CIO has over twenty years of experience in technology, data management, data science and analytics, earned a bachelor's degree in mechanical engineering and a master's degree in industrial engineering – operations research.
−Removed: Before joining JLL, our CIO previously held positions as Chief Data Officer, Global Head of Customer Intelligence, Head of Global Analytics and Head of Product Management for a large global financial services institution.
−Removed: We engage third-party consultants in connection with our cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats.
−Removed: These third-parties provide testing and advisory services to identify risks, improve the quality of controls, and ensure JLL is well-positioned to respond to cybersecurity incidents.
−Removed: Our cybersecurity program also includes assessments of cybersecurity threats associated with our use of certain third-party service providers.
−Removed: JLL leverages pre-procurement security assessments and post-procurement continuous monitoring to evaluate the security risk of certain third-party service providers.
−Removed: We regularly engage third-parties to provide technology and/or to perform facilities management and project management services to our clients, where we have imperfect visibility into our third-parties’ susceptibility to cybersecurity threats and/or their controls.
−Removed: We maintain a robust cyber incident response plan that includes controls and procedures designed to allow timely and accurate reporting of any material cybersecurity incident.
−Removed: We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources as well.
−Removed: We provide at least annual information security training program for employees who have access to JLL or client related sensitive or personal information and regularly conduct phishing tests and education.
−Removed: In 2023, we established a management executive committee that consists of our CISO, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer that is responsible for determining if a cybersecurity incident is material to the Company and requires disclosure.
−Removed: In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification.
−Removed: Although we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in our “Operational Risk Factors” in Item 1A, Risk Factors , of this report.
−Removed: Our business is highly dependent on our ability to collect, use, store and manage organizational and client data.
−Removed: If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our businesses, liability to clients, loss of client or other sensitive data, loss of employee data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage.
−Removed: These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy one or more of our office locations.
−Removed: As we outsource significant portions of our information technology functions to third-party providers, such as cloud computing, we bear the risk of having less direct control over the security and performance of those systems.
−Removed: Our cybersecurity risk is affected by cyber threats that are proliferating and advancing their ability to identify and exploit vulnerabilities, requiring continuous evaluation and improvements to our security architecture and cyber defenses.
−Removed: We also face increased cybersecurity risk as we deploy additional mobile and cloud technologies.
−Removed: We are continuously hardening our infrastructure built on these technologies, monitoring for threats, and evaluating our capability to respond to any incidents to minimize any impact to our systems, data, or business operations.
−Removed: Because we service clients across multiple industry verticals — many of which are higher-profile cyber targets themselves — including financial services, technology, government institutions, healthcare and life sciences, this also may increase the risk that we are subject to cyber-attack incidents.
−Removed: As noted above, we have experienced various types of cyber-attack incidents which thus far have been contained and not material to us.
−Removed: We continue to implement new controls, governance, technical protections and other procedures to mitigate against the risks of a cybersecurity event.
−Removed: We also maintain a cyber risk insurance policy but the costs related to cybersecurity threats or disruptions may not be fully insured.
−Removed: We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or vendors or suppliers we engage on behalf of our clients, fall victim to other successful cyberattacks.
−Removed: Table of Conte nts
−Removed: Our Management and the Board of Directors provide significant oversight of risks from cybersecurity threats and are informed about and closely monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.
−Removed: In May 2022, in furtherance of ensuring appropriate oversight of our cybersecurity and information technology readiness, the Board adopted an amended charter of the Audit Committee which added cybersecurity and information technology readiness as part of the committee’s purpose.
+Added: While certain attacks have been successful, thus far none have had a material impact on our or our clients' operations.
+Added: In addition, we acknowledge that cybersecurity threats could significantly impact our business strategy, operations, or financial condition.
+Added: As such, we continue to enhance our infrastructure, monitor for threats, and evaluate our response capabilities as we deploy additional mobile and cloud technologies.
+Added: Also refer to our discussion of material cybersecurity risks in the "Operational Risk Factors" section of Item 1A, Risk Factors , of this report.
+Added: Our Management and the Board of Directors provide significant oversight of cybersecurity risks.
+Added: In May 2022, the Board expanded the Audit Committee’s charter to include cybersecurity and information technology readiness.
In addition, the Audit Committee was renamed to the “Audit and Risk Committee” to more accurately align with its responsibility to assist the Board in overseeing our policies, program and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology.
−Removed: The Audit and Risk Committee and management’s Cyber Governance Committee receive regular reports from our CIO and CISO on our information security program including our top cybersecurity risks, cybersecurity strategy, information system controls and related security measures and improvements, cyber incident response plan, cyber incidents and cyber defense metrics, and cyber security protocols and trainings.
−Removed: These regular reports also are shared with the full Board of Directors.
+Added: Further enhancing our cybersecurity governance, in 2024, the Cybersecurity Subcommittee of the Audit and Risk Committee was formally established.
+Added: This subcommittee generally meets on a quarterly basis and regularly reports to the Audit and Risk Committee, providing an additional layer of specialized oversight on cybersecurity matters.
+Added: The Audit and Risk Committee, its Cybersecurity Subcommittee, and management’s Cyber Governance Committee receive regular reports on our information security program, including top risks, strategy, controls, incident response plans, metrics, and training protocols.
+Added: Reports are also shared with the full Board of Directors.
+Added: We maintain a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured.
+Added: We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm, and significant remediation expenses.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.