Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 308

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 16K
Chunk 308
---
Item 16K. Cybersecurity

We maintain an enterprise-wide information security and cyber risk management framework (“ Framework”) that is designed to protect our information, assets and systems and comply with applicable data security and privacy laws and regulations, in all jurisdictions in which we operate. Our Information Security and Cyber Risk Management Policy is aligned with the National Institute of Standards and Technology (“ NIST”) cybersecurity framework and sets out our internal framework to enable a consistent and coordinated approach to ensure that information security risks are adequately addressed in a manner proportionate to the nature, scale and complexity of our operations. Our framework is designed to protect information from the time it is created, through its useful life, to its ultimate authorized disposal.

Our cybersecurity program is designed to provide reasonable assurance that we will have efficient and effective operations; safeguard our assets; produce reliable reporting; comply with applicable laws and regulations; and to identify, protect, detect and respond to, and manage, reasonably foreseeable cybersecurity risks and threats. Our Framework is a key part of our internal control system and uses risk management processes to enable informed and prioritized decisions regarding information and cyber security.

Effective identification of information security and cyber risk enable us to focus and prioritize risk management efforts and determine resources required to manage the risks. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities and incidents. Risk identification processes span the entity, segment, function, and operational levels, to capture key risks within business processes, group-wide risks that are not directly associated with an individual function or process, and changes that could impact the internal control environment. Risk assessment involves a dynamic and iterative process for analyzing information security and cyber risks in order to form the basis for classifying information assets according to their value, sensitivity, and criticality; and for determining how risks should be managed, in accordance with our risk tolerance. Our risk assessment considers threats, vulnerabilities, exploitability, likelihood, and magnitude of impact to our operations, assets, individuals and facilities. Risk assessments also consider risk from external parties, including contractors who operate systems on our behalf, individuals who access our systems or data, service providers, and outsourcing entities. Risk assessments play an important role in the control selection processes. As internal and external circumstances change over time, risk identification also captures emerging information security and cyber risks. These and other emerging risks are reported to the Risk Committee of the Board.

Identified risks are recorded in the Group risk register and categorized, using the NIST security control family taxonomy to categorize and aggregate risk information. Once identified, all key