11 unchanged sentences
Cybersecurity risks are integrated into our overall enterprise risk management process.
−Removed: To defend, detect and respond to cybersecurity incidents, we, among other things:
−Removed: perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.
+Added: To defend, detect and respond to cybersecurity incidents, we, among other things perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.
We have implemented incident response and breach management processes which have four overarching and interconnected stages:
4 unchanged sentences
We also conduct tabletop exercises to simulate responses to cybersecurity incidents.
−Removed: Our risk management program also assesses third party risks, and we perform third-party risk management assessments to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers.
+Added: Our risk management program also assesses third-party risks where we identify and mitigate risks from third-parties such as vendors, suppliers, and other associated business partners.
Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data.
In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors.
−Removed: December 31, 2023 | 10-K 24
−Removed: CITIZENS, INC.
−Removed: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Cybersecurity and Technology Risks” included as part of our risk factor disclosures at Item 1A - Risk Factors - of this 10-K.
+Added: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Cybersecurity and Technology Risks” included as part of our risk factor disclosures at Part I.
+Added: Risk Factors of this 10-K.
While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.
1 unchanged sentence
We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.
+Added: December 31, 2024 | 10-K 23
+Added: CITIZENS, INC.
Cyber Governance
1 unchanged sentence
Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis.
−Removed: Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Vice President of Information Technology.
+Added: Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Chief Information Officer.
Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third-party audits.
6 unchanged sentences
Additionally, Gerald W.
−Removed: Shields, our CEO and a member of the Board, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, he has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.
+Added: Shields, our former Chief Executive Officer and now a member of the Board of Directors, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.
Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures.
−Removed: The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives a information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues.
+Added: The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives an information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues.
The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.
2 unchanged sentences
We also own properties in Louisiana related to our Home Service Insurance operations.
−Removed: LEGAL PROCEEDINGS
−Removed: MINE SAFETY DISCLOSURES
−Removed: Not applicable.
−Removed: December 31, 2023 | 10-K 25
−Removed: CITIZENS, INC.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.