What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-02-27 compared with 2025-03-03 · 31 added, 28 removed, 4 unchanged (94% of the section changed)

2 unchanged sentences

Cybersecurity.

Risk Management and Strategy

Due to the sensitivity of the personal information, including protected health information, or PHI, that the Company and its subsidiaries store and transmit, in the ordinary course of business, identifying, assessing, and managing material cybersecurity risks is an important component of the Company’s overall cybersecurity and enterprise risk management program.

We maintain a cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework’s guidance and HIPAA, which applies to the Company and each of its subsidiaries.

The cybersecurity program seeks to protect the enterprise against threats from cybersecurity risks, to comply with applicable laws and regulations, and to establish and enhance our processes for responding to cybersecurity events.

Among other things, the program includes the following components:

• security event monitoring and detection;

• extended detection and response;

• vulnerability scanning;

• security awareness and privacy training for personnel;

• phishing simulations;

• a cybersecurity incident response team.

The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.

The Company and its subsidiaries’ third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information.

We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers.

The program includes a third-party risk assessor, security risk reports, and formal business owner risk response.

During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries’ operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation.

For additional information related to risks from cybersecurity threats, please refer to Item 1.A.

— “Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our members, providers, or other third parties, could damage our reputation and brands, and substantially harm our business and results of operations.

The Company’s Board of Directors (the “Board”) oversees the Company’s overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee.

The Audit Committee reviews the adequacy and effectiveness of the Company’s cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our management, including our Chief Information Security Officer (the “CISO”) on cybersecurity matters, including, but not limited to:

AI Security, Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.

The Company’s CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation.

The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications.

The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms.

The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting.

The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.

Depending on the circumstances, information regarding cybersecurity risks and incidents may be elevated from the CISO and his team through a variety of different channels, including risk response forms as part of our formal security risk process, discussions with the Audit Committee and reports to the Board on a quarterly basis.

Cybersecurity Risk Management, Strategy, and Governance

The Company’s Board of Directors (the “Board”) oversees the Company’s enterprise risk management program, including risks related to cybersecurity.

The Board has delegated primary oversight of cybersecurity risk management to its Audit Committee.

The Audit Committee regularly reviews the adequacy and effectiveness of the Company’s cybersecurity program, including policies, internal controls, and risk management processes related to information security and data protection.

The Audit Committee and the full Board receive periodic reports from management, including the Company’s Chief Information Security Officer (the “CISO”), regarding the Company’s cybersecurity posture, risk assessment activities, emerging threat landscape, and mitigation efforts.

These reports address, among other topics, artificial intelligence–related security considerations, security awareness and training, internal and third-party risk management, incident response and disaster recovery readiness, identity and access management, HIPAA Security Rule compliance, phishing and social engineering risks, security monitoring, vulnerability and application security management, governance and policy maturity, data protection, and cloud security.

Management’s Role in Cybersecurity Risk Management

The Company’s CISO is responsible for the design, implementation, and ongoing management of the Company’s cybersecurity program , including security policies, standards, incident response, and remediation activities, in accordance with applicable legal and regulatory requirements.

The cybersecurity program is designed to identify, assess, manage, and mitigate risks to the confidentiality, integrity, and availability of the Company’s information systems and sensitive data.

The cybersecurity organization is supported by personnel with experience across healthcare, technology, and regulated industries and is informed by internal monitoring, independent assessments, audits, threat intelligence, and security tooling.

Cybersecurity risks and incidents are identified through a combination of automated monitoring systems, risk assessments, internal reporting mechanisms, and external intelligence sources.

The Company has implemented an automated, AI-assisted compliance and evidence management capability designed to support continuous monitoring, control validation, and documentation in connection with internal controls, regulatory compliance, and audit readiness.

These capabilities are intended to enhance efficiency and visibility into control performance;

however, they are subject to inherent limitations and operate under ongoing human oversight.

Artificial Intelligence–Related Security Considerations

The Company increasingly utilizes artificial intelligence–enabled technologies within its operations and also evaluates risks associated with the use of AI by third-party vendors and service providers .

AI-related security and governance risks are considered as part of the Company’s broader cybersecurity and enterprise risk management processes.

These considerations include, among other factors, risks related to data integrity, model governance, access controls, third-party dependencies, and the potential misuse of AI-enabled systems.

The Company’s approach to identifying and managing AI-related security risks is informed by recognized industry frameworks, including the NIST Artificial Intelligence Risk Management Framework, as appropriate to the Company’s use of AI-enabled technologies.

The Company’s use of automated and AI-assisted tools within its cybersecurity and compliance functions is intended to enhance monitoring, risk identification, and control validation;

however, such technologies are subject to inherent limitations and require ongoing human oversight.

The Company continues to evaluate its AI-related risk management practices as technologies, threat vectors, and regulatory expectations evolve.

Risk Escalation and Reporting

Cybersecurity risks and incidents are evaluated through a formal risk management process and escalated as appropriate based on severity, potential impact, and materiality considerations.

Depending on the circumstances, cybersecurity matters may be elevated from the CISO to senior management, the Audit Committee, and the Board through established reporting channels, including risk assessments, incident reports, and quarterly updates.

Fraud, Waste, and Abuse Monitoring

In addition, the Company began implementing a cybersecurity monitoring program, operated by the Company’s cybersecurity organization, in coordination with the Company’s other fraud, waste, and abuse and compliance functions.

As implementation progresses, the program is intended to evaluate provider, member, and vendor activity for indicators of potential credential exposure or misuse.

The program is designed to strengthen detection capabilities, reduce financial and compliance risk, and support the integrity of Company systems and data.

Subsidiary-Specific Oversight

The Company has established dedicated cybersecurity resources for Counterpart Health, a subsidiary of Clover Health, to ensure that cybersecurity risk management practices are aligned with enterprise standards while addressing subsidiary-specific operational and clinical considerations.

Not applicable.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments