6 unchanged sentences
See Item 1, “ Business—Enterprise Risk Management ” for additional information.
−Removed: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks.
−Removed: Our privacy and information security policies and standards govern our business lines and subsidiaries and encompass incident response, access control, and vendor management, among others.
−Removed: In order to develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business.
+Added: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks and incidents.
+Added: Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology (“IT”) processes encompassing incident response, access control, disaster recovery and testing, among other areas.
+Added: These policies and standards are regularly reviewed and updated at least annually based on the risk and regulatory environment in which we operate.
+Added: We monitor closely privacy and cybersecurity, AI and operational resilience laws, regulations and guidance applicable to us.
See Item 1, “ Business—Regulation—Cybersecurity and Privacy ” for additional details.
−Removed: We annually undergo an external evaluation by a third party cybersecurity firm with a specialty in penetration testing.
−Removed: Our vendor management group performs information security risk assessments on our third party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely.
+Added: We use many third parties for IT functions and our vendor management group performs information security risk assessments on our third-party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely.
The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third-party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third-party service providers.
−Removed: In addition, the Company negotiates appropriately protective terms in its legal agreements with these providers.
Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks.
−Removed: Computer viruses, hackers,
−Removed: employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business.
+Added: Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business.
+Added: We annually undergo an external penetration testing by a third-party cybersecurity firm.
+Added: These tests and our tabletop exercises enable us to incorporate recommendations and learnings in our program.
While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company .
1 unchanged sentence
In addition, new technology that could result in greater operational efficiency such as AI may further expose our information systems to the risk of cybersecurity incidents.
−Removed: See Item 1A, “ Risk Factors — Risk Relating to Our Indus try , Business & Op erations —Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation.”
−Removed: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training.
−Removed: Our Audit Committee, comprised of independent directors from our Board, oversees the Board’s responsibilities relating to the operational (including information technology (“IT”) risks, business continuity and data security) risk affairs of the Company.
−Removed: Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer (“CIO”) and Chief Operations Officer (“COO”), with input from our Chief Information Security Officer (“CISO”).
−Removed: Our cybersecurity and IT executives include our CIO, who has 33 years of experience in Information Technology,
+Added: See Item 1A, “ Risk Factors—Risk Relating to Our Industry, Business & Operations —Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation.”
ARCH CAPITAL 63
2024 FORM 10-K
−Removed: including 20 years in the financial services space.
−Removed: His responsibilities as the CIO include information security oversight, and board reporting.
+Added: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training.
+Added: Our Audit Committee, comprised of independent directors from our Board, oversees the Board’s responsibilities relating to the operational (including IT risks, business continuity and data security) risk affairs of the Company.
+Added: Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer (“CIO”) and Chief Operations Officer (“COO”), with input from our Chief Information Security Officer (“CISO”).
+Added: Our cybersecurity and IT executives include our CIO , who has 34 years of experience in Information Technology, including 21 years in the financial services space.
+Added: His responsibilities as the CIO include all areas of Information Technology and information security oversight.
Our CISO, has 19 years of experience in information security.
The CISO holds certifications from leading security associations.
+Added: The information security personnel reporting to the CISO hold various leading security certifications.
The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks.
6 unchanged sentences
and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.
−Removed: • The Operational Risk Committee (“ORC”), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks.
−Removed: Among other processes, the ORC reviews the Company’s programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime,
−Removed: business disruption, business continuity and disaster recovery.
+Added: • The Operational Risk Committee (“ORC”), comprised of senior IT, operations, risk, legal and compliance leaders
+Added: across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks.
+Added: Among other processes, the ORC reviews the Company’s programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.
Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO’s quarterly report to the Audit Committee.
3 unchanged sentences
The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.
+Added: We also have an enterprise Artificial Intelligence Governance and Oversight Committee focusing on the use and management of AI in our operations.
At the employee level, we maintain an experienced IT security team tasked with ongoing reviews of our technology systems, implementation of our privacy and cybersecurity program and support for the CIO and CISO in carrying out their reporting, security and mitigation functions.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.