Cybersecurity Risk Management and Strategy Disclosure |
9 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Blue Owl’s cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that they store or process; (ii) maintaining the security and availability of Blue Owl’s systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and Blue Owl’s responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties. Blue Owl has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that Blue Owl stores or processes, and the maintenance of critical services and systems. Blue Owl’s cybersecurity program is managed by Blue Owl’s Chief Technology Officer and Blue Owl’s Head of Technology Infrastructure (together, “Blue Owl IT Management”), who report to Blue Owl’s Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl’s monitoring and alert response processes, vulnerability management, changes made to Blue Owl’s critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl’s cybersecurity processes and systems are designed to protect against unauthorized access of information through Blue Owl’s systems and infrastructure, including by cyber attacks. Blue Owl’s policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl’s processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl’s cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework. Blue Owl’s cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl’s compliance with applicable laws and regulations as appropriate and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes. Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Blue Owl’s cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that they store or process; (ii) maintaining the security and availability of Blue Owl’s systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and Blue Owl’s responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties. Blue Owl has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that Blue Owl stores or processes, and the maintenance of critical services and systems.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the audit committee of the Board of Trustees (the “Audit Committee”). Blue Owl’s Chief Technology Officer periodically reports to the Audit Committee as as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl’s cybersecurity program, the external threat environment and Blue Owl’s programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl’s preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the audit committee of the Board of Trustees (the “Audit Committee”). Blue Owl’s Chief Technology Officer periodically reports to the Audit Committee as as well as our full Board of Trustees, as appropriate, on cybersecurity matters. |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the audit committee of the Board of Trustees (the “Audit Committee”). Blue Owl’s Chief Technology Officer periodically reports to the Audit Committee as as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl’s cybersecurity program, the external threat environment and Blue Owl’s programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl’s preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.
|
| Cybersecurity Risk Role of Management [Text Block] | Blue Owl has developed an incident response framework to identify, assess, manage, and report cybersecurity events, which is managed and implemented by Blue Owl’s Cyber Risk Operating Committee (the “C-ROC”), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl’s management, their audit committee or their board of directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior members of Blue Owl’s management, their audit committee or their board of directors, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel. Blue Owl’s cybersecurity program, which is overseen by the C-ROC, is managed by Blue Owl’s IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl’s monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes and various other technological and administrative safeguards.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Blue Owl has developed an incident response framework to identify, assess, manage, and report cybersecurity events, which is managed and implemented by Blue Owl’s Cyber Risk Operating Committee (the “C-ROC”), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The team is led by Blue Owl’s Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl’s Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Blue Owl’s cybersecurity program, which is overseen by the C-ROC, is managed by Blue Owl’s IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl’s monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl’s Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl’s Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl’s cybersecurity program.
|
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |