Company: AHL
Filing Date: 2025-05-08
Form Type: 424B4
Source: 0001628280-25-023859
Chunk: 344

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-05-08
Form: 424B4
Chunk 344
---
 includes a series of minimum and recommended cybersecurity standards, became effective on January 1, 2021. The Cyber Risk Code is designed to promote the stable and secure management of information technology systems of regulated entities and requires that all registrants implement their own technology risk programs, determine what their top risks are and develop an appropriate risk response. This requires all registrants to develop a cyber risk policy which is to be delivered pursuant to an operation cyber risk management program and appoint an appropriately qualified member of staff or outsourced resource to the role of Chief Information Security Officer. The role of the Chief Information Security Officer is to deliver the operational cyber risk management program. The Insurance (Group Supervision) Amendment Rules 2022, effective January 1, 2023, enhance the regime by imposing a requirement to report cyber events when an insurance group has knowledge, or reason to believe, that an event resulting in a significant adverse impact to the group’s operations, policyholders or clients has occurred within, at most, 72 hours and additionally within 14 days of the notification, the group must furnish the BMA with a report setting out known particulars of the case.

In November 2021, the board of directors of Aspen Bermuda approved a cyber risk policy. The board of directors of Aspen Bermuda must review and approve such policy on at least an annual basis, and reaffirmed its adoption of the cyber risk policy in November 2024. The BMA will assess a registrant’s compliance with the Cyber Risk Code in a proportionate manner relative to the nature, scale and complexity of its business. While it is acknowledged that some registrants will use a third party to provide technology services and that they may outsource their information technology resources (for example, to an insurance manager where applicable), when so outsourced, the overall responsibility for the outsourced functions will remain with the registrant’s board of directors. Failure to comply with the requirements of the Cyber Risk Code will be taken into account by the BMA in determining whether a registrant is conducting its business in a sound and prudent manner as prescribed by the Insurance Act and may result in the BMA exercising its powers of intervention and investigation.

### Management of Climate Change Risks
On March 9, 2023, the BMA published the Climate Change Guidance Notes. The Climate Change Guidance Notes apply to the Aspen Group and Aspen Bermuda and outline the BMA’s expectations regarding management and reporting of climate change risks. The Climate Change Guidance Notes focus on corporate governance and risk management practices for climate risk in the