KKR Infrastructure Conglomerate LLC 10-K Cybersecurity GRC - 2024-03-25

Page last updated on July 16, 2024

KKR Infrastructure Conglomerate LLC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-25 19:27:43 EDT.

Filings

10-K filed on 2024-03-25

KKR Infrastructure Conglomerate LLC filed a 10-K at 2024-03-25 19:27:43 EDT
Accession Number: 0001948056-24-000007

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity The Company is managed by the Manager. As an indirect subsidiary of KKR, the Manager is subject to and participates in KKR’s processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below. KKR has a Chief Information Security Officer (the “KKR CISO”), who leads an information security team (the “KKR information security team”) that is responsible for information security at KKR’s asset management business, including its cybersecurity strategy and program, which includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR’s security policies. The KKR information security team’s mandates can be broadly grouped into three categories: (i) operations and engineering, (ii) threat detection and response and (iii) governance. The KKR information security team members have a variety of relevant skill sets and expertise. For example, prior to joining KKR, KKR’s CISO was the CISO at another large financial institution where he was responsible for their global information security program. KKR’s CISO also has prior experience in various information security roles, including security architecture, application security, engineering and operations. He holds a Bachelor of Science in computer science from the New York University Polytechnic School of Engineering, is a Certified Information Systems Security Professional (CISSP) and holds a Series 99 - Operations Professional Exam certification. In addition, KKR information security team members have various backgrounds in information security, including in financial services and critical infrastructure, and the team maintains various levels of certifications - including CISSP, GIAC security operations certification, certified information security manager, and other certifications focused on specific technologies. The KKR CISO chairs the technology and information security risk committee for KKR’s asset management business, which consists of employees from the KKR’s technology group and other groups, including risk, legal and compliance. The technology and information security risk committee is responsible for overseeing the cybersecurity risk environment for KKR’s asset management business, which includes identifying and monitoring KKR’s technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at the firm. Periodically and at least annually, and more often as circumstances may require, KKR’s CISO and/or other members of the KKR information security team will present to the Audit Committee on various topics relating to KKR’s technology risks, including KKR’s cybersecurity program (including the results of a cybersecurity table top exercise), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes, and geopolitical cyber threat management), and risk management (including the results of periodic technology audits). For a discussion of how risks from cybersecurity threats affect the Company’s business, see “Item 1A. Risk Factors-Risks Related to Our Structure-Cybersecurity risks could result in the loss of data, interruptions in our business and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations.” Cybersecurity Risk Management and Strategy KKR’s asset management business has a cybersecurity incident response plan as a key component of its cybersecurity program, which is generally incorporated as part of KKR’s enterprise risk management program. The cybersecurity incident response plan includes details on the cybersecurity incident response management team, which includes members of the Company’s management team. The KKR CISO and KKR’s Chief Compliance Officer co-chair a cybersecurity incident response team (“KKR CIRT”), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR’s asset management business, including those arising from third-party service providers, including but not limited to, those providers that have access to KKR’s customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities. Members of the KKR CIRT include members of the firm’s legal, technology, compliance, risk, public affairs, fundraising and finance groups. The Company has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of the Company management and the Audit Committee. The KKR information security team undertakes a variety of measures to monitor and manage the cybersecurity risks of KKR’s asset management business. For example, the KKR information security team monitors KKR’s technology infrastructure with tools designed to detect suspicious behavior. KKR’s technology platforms and applications are designed 65 to enable it to monitor user and network behavior at KKR’s asset management business, identify threats using certain analytics, and mitigate attacks across various layers of the enterprise. The KKR information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in its cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of the cybersecurity program. In addition, the KKR information security team conducts periodic phishing simulations, and they also conduct periodic employee training on KKR’s security policies and controls and provide other security trainings as part of new employee onboarding. Additionally, the KKR CIRT conducts periodic tabletop exercises simulating a cybersecurity breach at KKR. As of the date of this Annual Report on Form 10-K, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the reporting period covered by this Annual Report on Form 10-K. However, companies like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect the Company’s business, see “Item 1A. Risk Factor-Risks Related to Our Structure-Cybersecurity risks could result in the loss of data, interruptions in our business and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations.”

Company Information