7 unchanged sentences
As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks and incidents.
−Removed: Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology (“IT”) processes encompassing incident response, access control, disaster recovery and testing, among other areas.
+Added: Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology (“IT”) processes encompassing incident response, access control, artificial intelligence, disaster recovery and testing, among other areas.
These policies and standards are regularly reviewed and updated at least annually based on the risk and regulatory environment in which we operate.
−Removed: We monitor closely privacy and cybersecurity, AI and operational resilience laws, regulations and guidance applicable to us.
+Added: We closely monitor privacy and cybersecurity, AI and operational resilience laws, regulations and guidance applicable to us.
See Item 1, “ Business—Regulation—Cybersecurity and Privacy ” for additional details.
We use many third parties for IT functions and our vendor management group performs information security risk assessments on our third party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely.
−Removed: The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third-party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third-party service providers.
+Added: The Company also requires these third party service providers to adhere to privacy and cybersecurity measures and has a third party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third party service providers.
Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks.
24 unchanged sentences
and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.
−Removed: • The Operational Risk Committee (“ORC”), comprised of senior IT, operations, risk, legal and compliance leaders
−Removed: across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks.
+Added: • The Operational Risk Committee (“ORC”), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks.
Among other processes, the ORC reviews the Company’s programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.
3 unchanged sentences
• The IT Steering Committee (“IT Committee”, which includes our CIO, CISO, COO and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives.
−Removed: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.
−Removed: We also have an enterprise Artificial Intelligence Governance and Oversight Committee focusing on the use and management of AI in our operations.
+Added: • The Artificial Intelligence Governance and Oversight Committee (“AIGOC”), which includes senior executives from IT, legal, compliance, risk and analytics, focuses on the governance of AI through the Company Artificial Intelligence Policy, annual training and vetting new AI technologies.
+Added: New AI use cases presented to the AIGOC for approval include a review of cybersecurity controls, among other considerations such as regulatory and business factors.
+Added: The P&S Committee, ORC, CIMT, AIGOC and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.
At the employee level, we maintain an experienced IT security team tasked with ongoing reviews of our technology systems, implementation of our privacy and cybersecurity program and support for the CIO and CISO in carrying out their reporting, security and mitigation functions.
−Removed: We also hold employee training on privacy and cybersecurity, records and information management, conduct regular phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.
+Added: We also hold employee training on privacy and cybersecurity, records and information management, conduct regular phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education to all our employees.
+Added: ARCH CAPITAL 66
+Added: 2025 FORM 10-K
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.