XML 92 R31.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company’s senior leadership team including senior representation from the firm’s operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which identifies and prioritizes key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm’s operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company’s information security awareness training and testing and assessment program.
We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training and perform monitoring, testing and surveillance activities relating to compliance with the firm’s policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic independent assurance that the firm’s internal controls are implemented and operating effectively.
With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has over 30 years of information technology experience, and reports to our Chief Information Officer (CIO), who has over 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has almost 40 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.
Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct internal monitoring and testing activities, such as phishing simulations.
Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on cyber risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company’s senior leadership team including senior representation from the firm’s operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which identifies and prioritizes key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm’s operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company’s information security awareness training and testing and assessment program.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Role of the Board of Directors
Our Board is responsible for overseeing management in the execution of its risk management responsibilities, including with respect to cybersecurity risk management. In addition, an overall review of risk is inherent in the Board’s ongoing oversight of our business, long-term strategies and other matters presented to our Board. Our Board exercises its risk oversight responsibilities periodically as part of actions taken and matters reviewed during its meetings and also through the activities of its standing committees. The Board has delegated responsibility for cybersecurity risk oversight to the Audit Committee.
The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events or trends impacting the Company. Annually, our CIO, Director of Technical Services and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company’s cybersecurity insurance program on an annual basis in connection with the program’s renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board has delegated responsibility for cybersecurity risk oversight to the Audit Committee.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Annually, our CIO, Director of Technical Services and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program.
Cybersecurity Risk Role of Management [Text Block]
Role of Management
Management is responsible for the assessment and management of risk, including cybersecurity risk. The Artisan Risk and Integrity Committee facilitates the annual enterprise risk assessment that identifies and prioritizes the Company’s key risks, including cybersecurity risk. The information security governance team also reports to members of senior management the results of its annual cybersecurity risk assessment.
Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through the established reporting lines of the CIO and CISO and through its oversight of the information security program.
In the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company’s Chief Legal Officer, Chief Administrative Officer, Chief Operating Officer and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident’s potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Role of Management
Management is responsible for the assessment and management of risk, including cybersecurity risk. The Artisan Risk and Integrity Committee facilitates the annual enterprise risk assessment that identifies and prioritizes the Company’s key risks, including cybersecurity risk. The information security governance team also reports to members of senior management the results of its annual cybersecurity risk assessment.
Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through the established reporting lines of the CIO and CISO and through its oversight of the information security program.
In the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company’s Chief Legal Officer, Chief Administrative Officer, Chief Operating Officer and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident’s potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.
Role of the Board of Directors
Our Board is responsible for overseeing management in the execution of its risk management responsibilities, including with respect to cybersecurity risk management. In addition, an overall review of risk is inherent in the Board’s ongoing oversight of our business, long-term strategies and other matters presented to our Board. Our Board exercises its risk oversight responsibilities periodically as part of actions taken and matters reviewed during its meetings and also through the activities of its standing committees. The Board has delegated responsibility for cybersecurity risk oversight to the Audit Committee.
The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events or trends impacting the Company. Annually, our CIO, Director of Technical Services and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company’s cybersecurity insurance program on an annual basis in connection with the program’s renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has almost 40 years of experience in the field of cybersecurity.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] On a quarterly basis, management reports on any significant cybersecurity events or trends impacting the Company.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true