2 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology (“NIST”) Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company’s risk management framework.
+Added: Everest has aligned and operationalized its cybersecurity program and controls with the National Institute of Standards and Technology (“NIST”) Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company’s risk management framework.
As part of the Company’s cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response.
−Removed: The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center (“SOC”) as well as a incident response team (“IRT”), to further escalate to senior management and the Board, as appropriate.
+Added: The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center (“SOC”) as well as an incident response team (“IRT”), to further escalate to senior management and the Board, as appropriate.
While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of incidents to law enforcement and regulatory bodies, as appropriate.
3 unchanged sentences
The SOC also initiates incident response protocols, including escalating threats as needed to the IRT, including the Chief Information Security Officer (“CISO“), who can further escalate to other members of senior management and the Board, as may be appropriate.
+Added: Additionally, as compromised credentials and unauthorized access remain prevalent vectors for
+Added: cyberattacks, we have prioritized the advancement of our Identity and Access Management (IAM) protocols as a critical component of our cybersecurity strategy.
+Added: We continue to modernize and strengthen access controls, password policies, multi-factor authentication, and offboarding processes, to ensure that access to sensitive data and systems is restricted to authorized personnel and necessary business functions for the time period needed.
Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises and incident response exercises are used to test the effectiveness of the overall cybersecurity control environment.
10 unchanged sentences
The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology.
−Removed: The Company’s Board, through its committees, referenced above in ITEM 1 “Business” - Enterprise Risk Management, has ultimate responsibility for risk oversight.
+Added: The Company’s Board, through its committees, referenced above in ITEM 1, “Enterprise Risk Management”, has ultimate responsibility for risk oversight.
In 2024, a Technology and Cyber Board Committee was established to further assist the Company Board’s oversight responsibilities with respect to information technology governance, strategy, delivery and risk management, including cybersecurity and data privacy.
3 unchanged sentences
The Company also appointed a certified CISO who has significant public and private cybersecurity experience.
−Removed: The CISO is dedicated to assessing the Company’s data security risk, monitoring cyber threat intelligence and taking the steps
−Removed: necessary to implement pertinent safeguards and protocols to manage the risk.
−Removed: In addition, the ERC, referenced above in ITEM 1 “Business” - Enterprise Risk Management, annually reviews the Company’s cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company.
+Added: The CISO is dedicated to assessing the Company’s data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk.
+Added: In addition, the ERC, referenced above in ITEM 1, “Enterprise Risk Management”, annually reviews the Company’s cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company.
The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company’s CISO to assess the Company’s vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business.
2 unchanged sentences
The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.
−Removed: Everest Re’s corporate offices are located in approximately 321,500 square feet of leased office space in Warren, New Jersey.
−Removed: Bermuda Re’s corporate offices are located in approximately 12,300 total square feet of leased office space in Hamilton, Bermuda.
−Removed: The Company’s 33 other locations occupy a total of approximately 335,300 square feet, all of which are leased.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.