1 unchanged sentence
CYBERSECURITY
−Removed: Our cybersecurity program, led by our Global Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”), is designed to protect and preserve the confidentiality, integrity and availability of all information and systems owned by us or in our care.
−Removed: The Audit and Risk Committee of our Board of Directors oversees cybersecurity, as outlined in its charter and disclosed in our proxy statement.
−Removed: In addition, cybersecurity is reviewed as part of our enterprise risk management program led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit and Risk Committee of our Board of Directors.
−Removed: Our cybersecurity strategy implements layered controls aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework to minimize both the likelihood and potential impact of cybersecurity events.
−Removed: Our CISO, who holds advanced qualifications and has extensive experience in cybersecurity, leads a global team of cybersecurity professionals.
−Removed: Our CISO reports to our CIO who is responsible for the Company's technology, data and information management strategy, and brings over two decades of relevant experience to the role.
−Removed: We engage third-party consultants for assessing, identifying and managing material cybersecurity risks, including those associated with certain third-party providers.
−Removed: We maintain a cyber incident response plan and regularly conduct simulations and tabletop exercises.
−Removed: In 2023, we established an executive management group responsible for determining the materiality of cybersecurity incidents and necessary disclosures.
−Removed: This group consists of our CISO, Chief Financial Officer, Chief Legal Officer and Chief Accounting Officer.
+Added: Risk Management and Strategy
Like other companies with a large technology footprint and high-profile client base, we are regularly subject to cyberattacks.
−Removed: While certain attacks have been successful, thus far none have had a material impact on our or our clients' operations.
−Removed: In addition, we acknowledge that cybersecurity threats could significantly impact our business strategy, operations, or financial condition.
−Removed: As such, we continue to enhance our infrastructure, monitor for threats, and evaluate our response capabilities as we deploy additional mobile and cloud technologies.
−Removed: Also refer to our discussion of material cybersecurity risks in the "Operational Risk Factors" section of Item 1A, Risk Factors , of this report.
+Added: While certain attacks against us have been successful, thus far none have had a material impact on our or our clients' operations.
+Added: To respond to the threat of cybersecurity breaches and cybersecurity attacks, we have developed and maintain a comprehensive global cybersecurity program.
+Added: The program utilizes internal and external assessments to continually improve our overall cybersecurity posture and manage technology risk.
+Added: Our cybersecurity strategy has implemented layered technical and administrative controls, which are aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) to minimize both the frequency and severity of cybersecurity events.
+Added: Specific to our external assessments, we routinely engage third-party consultants to assess our overall cybersecurity maturity and improve our ability to identify and manage material risks stemming from a cybersecurity event.
+Added: Additionally, as a material cybersecurity incident can manifest from outside of the organization, JLL leverages security assessments and continuous monitoring to evaluate the security risk of third-party service providers.
+Added: In 2023, we established an executive management group responsible for determining the materiality of cybersecurity incidents and ensuring proper disclosure if required.
+Added: While we have not experienced any material cybersecurity events to date, we acknowledge cybersecurity threats could significantly impact our business strategy, operations, or financial condition.
+Added: In our commitment to reducing the frequency and severity of a cybersecurity event, we maintain a cybersecurity incident response plan and regularly conduct tabletop exercises to bolster our preparedness.
+Added: JLL's cybersecurity function has a risk management framework for cyber-related risks, detailing controls and improvements.
+Added: The cybersecurity function provides regular updates to our Chief Risk Officer on cybersecurity threats, incidents, and JLL’s prevention, detection, mitigation, and remediation efforts for managing these risks.
+Added: Our Enterprise Risk Management (“ERM”) program is designed to evaluate and monitor significant risks, including cybersecurity, and places them in JLL's overall risk framework.
+Added: Our Global Executive Board and Audit and Risk Committee receive regular reporting on cyber risks and mitigation from both ERM and the cybersecurity function.
+Added: We maintain a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured.
+Added: We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm and significant remediation expenses.
+Added: For additional information on material cybersecurity risks, refer to our discussion in the "Operational Risk Factors" section of Item 1A, Risk Factors, of this report.
Our Management and the Board of Directors provide significant oversight of cybersecurity risks.
−Removed: In May 2022, the Board expanded the Audit Committee’s charter to include cybersecurity and information technology readiness.
+Added: Since 2022, the Board expanded the Audit and Risk Committee’s charter to include cybersecurity and information technology readiness.
In addition, the Audit Committee was renamed to the “Audit and Risk Committee” to more accurately align with its responsibility to assist the Board in overseeing our policies, program and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology.
−Removed: Further enhancing our cybersecurity governance, in 2024, the Cybersecurity Subcommittee of the Audit and Risk Committee was formally established.
−Removed: This subcommittee generally meets on a quarterly basis and regularly reports to the Audit and Risk Committee, providing an additional layer of specialized oversight on cybersecurity matters.
−Removed: The Audit and Risk Committee, its Cybersecurity Subcommittee, and management’s Cyber Governance Committee receive regular reports on our information security program, including top risks, strategy, controls, incident response plans, metrics, and training protocols.
+Added: Further enhancing our cybersecurity governance, in 2024, the Board formally established the Cybersecurity Subcommittee of the Audit and Risk Committee.
+Added: This subcommittee meets on a quarterly basis with management and regularly reports to the Audit and Risk Committee, providing an additional layer of specialized oversight on cybersecurity and information technology matters.
+Added: Management’s role in executing our cybersecurity strategy is led by our Global Chief Information Officer (“CIO”) and our Chief Information Security Officer (“CISO”) both with over twenty years’ experience in large institutions.
+Added: Our CISO leads our cybersecurity program, holds a master's degree in business administration and has over twenty years of relevant experience, including cybersecurity and enterprise security leadership roles in Financial Services and within the Department of Defense.
+Added: Our CISO reports to our CIO who is responsible for the development and implementation of our technology, data and information management strategy.
+Added: Our CIO's educational background includes a bachelor's degree in mechanical engineering and a master's degree in industrial engineering – operations research, providing a strong foundation for work in technology, data management, data science and analytics.
+Added: Management’s Cybersecurity Governance Committee, established in 2022, comprises senior executives representing several business segments and corporate functions.
+Added: It provides an additional level of oversight for cybersecurity policies and serves as a formal channel to communicate cybersecurity decisions with our Global Executive Board.
+Added: The Audit and Risk Committee, its Cybersecurity Subcommittee, and management’s Cybersecurity Governance Committee receive regular reports on our information security program, including top risks, strategy, controls, improvement projects, metrics, and training protocols.
Reports are also shared with the full Board of Directors.
−Removed: We maintain a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured.
−Removed: We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm, and significant remediation expenses.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.