3 unchanged sentences
The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cybersecurity risk management.
−Removed: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes.
+Added: This integration ensures that cybersecurity considerations are an integral part of the Company’s decision-making processes.
The Company regularly assesses risks from cybersecurity threats and monitors its computer networks for vulnerabilities.
4 unchanged sentences
Risks are also identified through independent assessments performed by third-party consultants and the internal audit function.
−Removed: • Risk management – the Chief Technology Officer oversees a process designed to protect against and remediate risks according to their criticality and presents to the Risk Oversight and Audit Committees of the Board of Directors and management at least semi-annually.
−Removed: The Chief Information Security Officer also presents to the Board of Directors and Risk Oversight Committee on cybersecurity and data privacy matters at least annually.
+Added: • Risk management – the Chief Technology Officer oversees a process designed to protect against and remediate risks according to their criticality and presents to the Risk Oversight and Audit Committees of the Board and management at least semi-annually.
+Added: The Chief Information Security Officer also presents to the Board and Risk Oversight Committee on information technology, cybersecurity and data privacy matters at least annually.
The Company’s Information Security Policy and Standards details a process for responding to cybersecurity events.
2 unchanged sentences
The Company engages third-party consultants to conduct periodic penetration testing designed to identify potential security vulnerabilities.
−Removed: The Company’s internal audit function, which has been outsourced to an international accounting firm, conducts periodic audits of cybersecurity and reports on such matters to the Audit Committee of the Board of Directors.
+Added: The Company’s internal audit function, which has been outsourced to an international accounting firm, conducts periodic audits of cybersecurity and reports on such matters to the Audit Committee of the Board.
The Company takes measures designed to mitigate risks associated with third-party vendors that have access to confidential information or provide business critical functions.
Through its vendor management program, the Company screens these third-party vendors to assess their data security protocols both prior to initial engagement and periodically thereafter for compliance with the program standards.
−Removed: The Company has not experienced any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected, or that it believes are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.
−Removed: The Board of Directors oversees the risk management process, including overall responsibility for overseeing management’s establishment and operation of a cybersecurity program.
−Removed: The Board of Directors delegates certain cybersecurity oversight responsibilities to the Risk Oversight Committee, which oversees enterprise risk, vendor management, and information technology risks, and to the Audit Committee, whose oversight responsibility includes cybersecurity risks, data privacy and risk management related to the Company’s financial systems.
+Added: The Company seeks contractual obligations from third-party vendors to notify it in the event of a cybersecurity incident, and monitors threat intelligence reports as well as current reports of SEC-registered vendors and their sub-service providers that have access to confidential information or provide business critical functions for cybersecurity incidents.
+Added: The Company has not experienced any cybersecurity incidents that have materially affected, or that it believes are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.
+Added: Under the Company’s cybersecurity governance framework, the Board has overall responsibility for overseeing management’s establishment and operation of a cybersecurity program.
+Added: Members of the Board have broad-based skills in risk management oversight and/or cybersecurity oversight certifications.
+Added: The Board delegates certain cybersecurity oversight responsibilities to the Risk Oversight Committee, which oversees enterprise risk, vendor management, and information technology risks, including assessing and managing cybersecurity and data privacy risks, and to the Audit Committee, whose oversight responsibility includes, as part of its oversight of the Company’s system of internal controls over financial reporting, assessing and managing financial risk exposures, including information technology, cybersecurity and data privacy risk related to the Company’s financial systems.
The Risk Oversight Committee has specific responsibility for overseeing information technology processes and controls, including for cybersecurity, data privacy, compliance with related policies, and the process to monitor risks to the Company arising from changing technology trends, and coordinates with the Audit Committee, as needed.
1 unchanged sentence
The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations.
−Removed: To that end, the Company has implemented a cybersecurity governance structure.
−Removed: The Board of Directors, some of whose members have broad-based skills in risk and management oversight and/or cybersecurity oversight certifications, oversees the risk management process.
−Removed: The Board of Directors employs an enterprise-wide approach to risk management that supports the Company’s business plans within a reasonable level of risk.
−Removed: In the Company’s view, risk assessment and risk management entail not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for that company.
−Removed: The Board of Directors annually approves the Company’s business plan, factoring in risk management.
−Removed: It also approves the Company’s risk appetite statement, which articulates the Company’s tolerance for risk and describes the general types of risk that the Company accepts or attempts to avoid.
−Removed: The involvement of the Board of Directors in setting the Company’s business strategy is a key part of its assessment of management’s risk tolerance and a determinant of what constitutes an appropriate level of risk for the Company.
−Removed: While the Board of Directors has the ultimate oversight responsibility for the risk management process, various committees of the Board of Directors also have responsibility for overseeing the Company’s risk assessment and risk management process.
−Removed: The Risk Oversight Committee has specific responsibility for overseeing information technology matters, including assessing and managing cybersecurity and data privacy risks, and coordinates with the Audit Committee, which assesses and manages financial risk exposures, including cybersecurity and data privacy risks, as part of its oversight of the Company’s system of internal control over financial reporting.
−Removed: As described above in Cybersecurity – Risk Management and Strategy, the Company’s Chief Technology Officer has management responsibility for overseeing a process designed to remediate cybersecurity risks, and reports to the Board of Directors, Risk Oversight Committee, Audit Committee and management at least semi-annually.
−Removed: The Chief Technology Officer reported to the Board of Directors, Risk Oversight Committee and Audit Committee four times in 2023.
+Added: As described above in Cybersecurity – Risk Management and Strategy, the Company’s Chief Technology Officer has management responsibility for overseeing a process designed to remediate cybersecurity risks, and reports to the Board, Risk Oversight Committee, Audit Committee and management at least semi-annually.
+Added: The Chief Technology Officer reported to the Board, Risk Oversight Committee and Audit Committee four times in 2024.
The Chief Technology Officer has over 25 years of experience in information technology, technology research and security and operations management, with over 15 of those years focused in financial services and insurance.
1 unchanged sentence
The Company has appointed a Chief Information Security Officer, who is responsible for leading the assessment and management of cybersecurity risk.
−Removed: In 2023, the Chief Information Security Officer made an annual report on information technology and cybersecurity risks to the Board of Directors and Risk Oversight Committee and made four quarterly reports to the Audit Committee.
+Added: In 2024, the Chief Information Security Officer made an annual report on information technology and cybersecurity risks to the Board and made four quarterly reports to the Risk Oversight Committee and the Audit Committee.
The Chief Information Security Officer has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA).
−Removed: The Chief Information Security Officer reports to the Board of Directors, its committees, and management on cybersecurity threats on a regular basis.
+Added: Chief Information Security Officer reports to the Board, its committees, and management on cybersecurity threats on a regular basis.
The Company uses various tools to prevent, detect, and mitigate cybersecurity incidents.
−Removed: The Company has procedures in place to respond to cybersecurity incidents, which include prompt meeting of the Cybersecurity Incident Disclosure Committee, a Company management committee, to assess cybersecurity incidents and determine materiality requiring disclosure on Form 8-K, notification of the Board of Directors of any material cybersecurity incidents, quarterly reporting by the Chief Information Security Officer of material and non-material incidents to the Risk Oversight Committee and management, and to the Audit Committee of such incidents related to the Company’s financial systems.
+Added: The Company has procedures in place to respond to cybersecurity incidents, which include prompt meeting of the Cybersecurity Incident Disclosure Committee, a Company management committee, to assess cybersecurity incidents and determine materiality requiring disclosure on Form 8-K, notification of the Board of any material cybersecurity incidents, quarterly reporting by the Chief Information Security Officer of material and non-material incidents to the Risk Oversight Committee and management, and to the Audit Committee of such incidents related to the Company’s financial systems.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.