UNRESOLVED STAFF COMMENTS
+Added: Return to table of contents
CYBERSECURITY
4 unchanged sentences
Cybersecurity and IT compliance risk metrics are monitored regularly to assess, identify, manage and protect our environment.
−Removed: Periodic audits of IT and Cybersecurity are carried out as part of internal and external audits and are performed by professionals.
+Added: Periodic audits of IT and Cybersecurity are carried out as part of internal and external audits, are performed by professionals and form a part of our overall risk management system and processes.
Our approach to third-party cybersecurity underscores a commitment to robust risk management and adherence to industry best practices.
By implementing comprehensive measures in line with recognized standards, we ensure that our third-party cybersecurity protocols are aligned with rigorous standards.
−Removed: Regular assessments, SOC reviews, and collaborative efforts
−Removed: Link to Table of Contents
−Removed: are integral components of our strategy, aimed at fostering a secure and resilient ecosystem that safeguards sensitive information and maintains the integrity of our digital infrastructure in partnership with external entities.
+Added: Regular assessments, SOC reviews, and collaborative efforts are integral components of our strategy, aimed at fostering a secure and resilient ecosystem that safeguards sensitive information and maintains the integrity of our digital infrastructure in partnership with external entities .
We have a Chief Information Security Officer ("CISO") and have an IT Steering Committee ("ITSC").
Our CISO is responsible for establishing the cybersecurity vision for the Company, determining and prioritizing cybersecurity initiatives, and keeping abreast of developing security threats.
−Removed: The ITSC reports to the Board and Audit Committee, is chaired by our Chief Risk Officer (“CRO”), and has our CISO, Chief Financial Officer (“CFO”), and GRILChief Executive Officer, and SEC Reporting Officer as some of its members.
+Added: The ITSC reports to the Board and Audit Committee, is chaired by our Head of IT and Software Development (“Head of IT”), and has our CISO, CFO, COO, and SEC Reporting Officer as some of its members.
Our CISO brings over three decades of expertise in the IT Industry and is a member of ISACA, showcasing a rich portfolio of industry certifications like the Certified Information Security Manager (“CISM”), Certified Data Privacy Solutions Engineer (“CPDSE”), and Microsoft Certified Systems Engineer (“MCSE”).
The CISO also holds accreditations from vendors such as CISCO and Microsoft.
−Removed: Our CRO has over 20 years’ experience in the property and casualty reinsurance industry, and significant expertise in the field of risk management.
−Removed: He holds a CISM certification, as well as a B.Sc.
−Removed: in Mathematics and a Ph.D.
−Removed: in Computer Science from the University of Salford.
+Added: Our Head of IT brings two decades of experience in aligning technology initiatives with business goals and managing IT strategy.
+Added: With a background of over 15 years in insurance and reinsurance, the Head of IT is responsible for ensuring the implementation and adherence to governance and cybersecurity frameworks.
Other members of the ITSC hold relevant qualifications and collectively, the ITSC has substantial experience and expertise in cybersecurity, risk, strategy, and management.
8 unchanged sentences
The Audit Committee is further tasked with discussing with management the policies with respect to risk assessment and risk management, including those related to technology and cybersecurity.
−Removed: The CRO presents an IT and Cybersecurity update to the Audit Committee on a quarterly basis and additionally as needed, to inform it of any new or emerging cybersecurity threats or risks.
−Removed: For the year ended December 31, 2023, we have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.
+Added: An IT and Cybersecurity presentation is made to the Audit Committee quarterly and additionally as needed, to inform it of any new or emerging cybersecurity threats or risks.
+Added: We have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.
See “Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.