01 04.4 Business conduct and operational risk management continued Principles 3 5 Introduction 02 Sustainable investing Cybersecurity Business resilience Business recovery plans are mapped to each major 03 function. This ensures that key business processes can Active stewardship Strong cybersecurity is essential for protecting our Business resilience (incorporating business continuity resume in the event of a serious interruption to business systems, data and communications from intended and disaster recovery) is an essential component of our activities. Plans cover the major risk scenarios of a loss 04 and unintended misuse. As such, our cybersecurity service commitment to our clients. The importance of of employees, facilities, technology and third-party AllianzGI as a sustainable business programme is a fundamental to the sustainability business resilience came to the fore during the Covid-19 04.1 B uilding our approach to of our business. pandemic. Our Business Resilience team provided support. Business Resilience teams enforce a review of sustainable investing constant oversight of the frequent changes to local business recovery plans every year. To ensure practicality 04.2 Developing a shared vision for We focus on designing, operating and monitoring an government requirements to support the pandemic and effectiveness, we run testing on the highest risk inclusion and diversity appropriate level of preventive, detective and responsive efforts. This co-ordination ensured that our employees plans and most critical processes, IT applications and 04.3 P romoting employee health security controls. This is a priority as increasingly more could move efficiently and safely between remote systems. These tests are planned on a multi-year cycle and wellbeing in a hybrid complex attack methods impact organisations around working and office locations to support the business to confirm recovery capabilities. work environment the world. At the same time, our digital assets are and our clients. Through a programme of continuous improvement, we 04.4 Business conduct and evolving and expanding and we are implementing collect and analyse feedback to improve the effectiveness operational risk management new technology to meet growing business demand. Our business resilience framework is a multi-tiered risk 04.5 Managing the environmental Both the increasing maturity of attackers and our defence model supported by input from steering groups, of the business resilience framework. A recent major impact of our operations evolving business signal the need for a sophisticated a corporate resilience organisation and each function global crisis management exercise showcased the ability 04.6 Corporate citizenship cybersecurity programme. within the firm. The programme is subject to oversight by of our Global Crisis Unit to successfully manage through Allianz and Allianz Asset Management (AAM). Annual a ransomware attack and minimise potential damage to 05 To protect AllianzGI from cyber risks, we select best self-assessments are submitted to AAM in accordance the firm and our clients. Appendix practices from multiple cybersecurity frameworks, such with Group requirements and the programme is subject as the International Organization for Standardization to periodic audit reviews. The Business Resilience team (ISO) or the National Institute of Standards and manages and administers the programme, ensuring Technology (NIST). These frameworks set standards all business functions comply with the framework and for processes, controls, security testing and reporting. policies. Its role includes: However, there can never be 100% protection against a cyberattack. Therefore, we also focus on controls and • Creating policies, procedures and guidelines training around how to recover from a successful attack, • Identifying threats and weaknesses with the aim of reducing the impact and duration of business disruption to a tolerable level. • Implementing controls • Developing tools and best practices • Delivering training and awareness.