1 unchanged sentence
CYBERSECURITY
−Removed: Like other firms in the financial services sector, insurers like us are particularly vulnerable to cybercrime due to our large amounts of customer data.
+Added: Like other firms in the financial services sector, insurers like us are particularly vulnerable to cybercrime due to the nature and volume of customer data we maintain.
Insurance-related data is particularly interesting to cybercriminals because of its inherent confidentiality.
7 unchanged sentences
Cybersecurity risks are integrated into our overall enterprise risk management process.
−Removed: To defend, detect and respond to cybersecurity incidents, we, among other things perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.
+Added: To defend, detect and respond to cybersecurity incidents, we, among other things, periodically perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.
We have implemented incident response and breach management processes which have four overarching and interconnected stages:
12 unchanged sentences
We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.
−Removed: December 31, 2024 | 10-K 23
−Removed: CITIZENS, INC.
Cyber Governance
Cybersecurity is a key element of the Company's enterprise risk management ("ERM").
−Removed: Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis.
+Added: Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who
+Added: December 31, 2025 | 10-K 21
+Added: CITIZENS, INC.
+Added: is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis.
Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Chief Information Officer.
5 unchanged sentences
Our CISO is a Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA"), and a member of the ISACA and ISSA organizations.
−Removed: He received his bachelors’ degree from Middle Tennessee State University and served in the United States Marine Corps.
−Removed: Additionally, Gerald W.
−Removed: Shields, our former Chief Executive Officer and now a member of the Board of Directors, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.
−Removed: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures.
−Removed: The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives an information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues.
+Added: Our Audit Committee Charter tasks its committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures.
+Added: The Audit Committee meets quarterly and receives an information security update report from the Company's CISO, which includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues.
The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.
−Removed: We lease our principal office at the Domain in Austin, Texas to service all business entities and operations.
−Removed: We lease space in Puerto Rico for CICA International and in Louisiana, Arkansas and Mississippi related to our Home Service Insurance operations.
−Removed: We also own properties in Louisiana related to our Home Service Insurance operations.
+Added: We lease our principal office at the Domain in Austin, Texas.
+Added: We also lease space in Puerto Rico for CICA International and offices in Louisiana, Arkansas and Mississippi related to our SPLIC opera tions.
+Added: We also own a small amount of property in Louisiana.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.