Company: AHL
Filing Date: 2025-04-29
Form Type: F-1/A
Source: 0001628280-25-020463
Chunk: 369

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-04-29
Form: F-1/A
Chunk 369
---
 company are normally based upon the proportion of each insurer’s (and in some cases the insurer’s and its affiliates’) written premium for coverages similar to those provided by the pool, and are frequently uncapped.

#### Cybersecurity and Privacy Laws and Regulations
Federal and state laws and regulations require financial institutions, including insurers, to protect, among other things, the security and confidentiality of personally identifiable information and nonpublic personal information, to notify customers and other individuals about their policies and practices relating to their collection and disclosure of customer information and their practices relating to protecting the security and confidentiality of that information, and to notify regulators and consumers in the event of certain data breaches affecting personal information. Federal and state laws and regulations also regulate the ability of financial institutions to make telemarketing calls and to send unsolicited e-mail or fax messages to consumers and customers. The Gramm-Leach-Bliley Act (“GLBA”) requires financial institutions to implement administrative, technical, and physical safeguards to ensure the confidentiality, integrity, security, and proper disposal of nonpublic personal information, as well as limitations on the re-disclosure and re-use of such information.

In 2017, cybersecurity rules took effect for financial institutions, insurers and certain other companies supervised by the New York Department of Financial Services (the “NYDFS Cybersecurity Regulation”), such as AAIC, which is licensed in New York. The NYDFS Cybersecurity Regulation imposes significant regulatory requirements intended to protect the confidentiality, integrity and availability of information systems, and the information stored within, such as requirements regarding governance, incident planning, training, data management, system testing and regulator notification in the event of certain cybersecurity events. On November 1, 2023, NYDFS announced its adoption of the second amendment of the NYDFS Cybersecurity Regulation, which includes updated requirements related to: governance; controls to prevent unauthorized access to information systems, such as password controls and monitoring; risk and vulnerability assessment requirements; notification requirements; and cybersecurity training. We anticipate that the NYDFS will continue to examine the cybersecurity programs of financial institutions in the future and such examinations may result in additional expenditure of resources and regulatory scrutiny.

In 2017, the NAIC also adopted the Insurance Data Security Model Law (the “Cybersecurity Model Law”). The Cybersecurity Model Law requires insurers, insurance producers and other entities required to be licensed under state insurance laws to comply with certain requirements under state insurance laws, such as developing and maintaining a written information security program, overseeing the data security practices of third-party vendors, and providing notice of