Company: ELV
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001156039-25-000010
Chunk: 92

Company: Elevance Health, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 92
---
2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, cash flows, financial condition or results of operations; however, future cybersecurity incidents or threats may materially affect us, including by affecting our business strategy, results of operations or financial conditions. See Part I, Item 1A. “Risk Factors” for more information on the Company’s cybersecurity-related risks.

 -38-

Management and Governance of Cybersecurity Risk

To manage our cybersecurity risk, we employ a cross-organizational steering committee, the Information Security Steering Committee (“ISSC”), that supports the direction and governance of our enterprise-wide Information Security Program. The ISSC is chaired by our Chief Information Security Officer (“CISO”) and is comprised of accountable senior business leaders including our Chief Compliance Officer (“CCO”), Chief Risk Officer (“CRO”), legal counsel, and human resources, procurement and business segment leaders.In addition to the ISSC, we have defined risk functions to cover overall enterprise risks and information technology and cybersecurity risks within our enterprise risk management framework, including, but not limited to: our IT Risk Management program, led by our CISO; our Responsible Artificial Intelligence (“RAI”) Program, led by our Chief Digital Information Officer; Compliance, led by our CCO; Internal Audit, led by our Chief Audit Executive (“CAE”); Enterprise Risk Management programs led by our CRO; Third-Party Risk Management, comprised of business and information security leaders; IT due diligence processes, led by business, technology and information security leaders; and our Corporate Insurance Program, including cybersecurity insurance, led by our Treasurer.To evaluate cybersecurity and privacy incidents and enable us to comply with public disclosure requirements, we have a Privacy and Security Incident Response and Reporting Policy and Procedure (the “Policy”) with defined escalation criteria (the “Plan”) in support of our incident response processes. The Plan provides a framework to our Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer (“CPO”), CISO and applicable legal counsel and business and corporate services leaders, for responding to cybersecurity incidents. The Policy, together with the Plan, identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation based on facts and circumstances of each incident, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, including to our chief legal officer and CEO, a subcommittee of our SEC disclosure committee, and ultimately, our Board of Directors and appropriate Board committees. The Policy also