Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 1071

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 1071
---
 a forum for regulators to learn about, monitor and confer on emerging technology issues, including, among others, cybersecurity and AI. State Departments of Insurance and other state government agencies and legislatures are increasingly aware and active in providing guidance in the AI space.

The Cybersecurity Information Sharing Act of 2015 encouraged organizations to share cyber threat indicators with the federal government and, among other things, directed HHS to develop a set of voluntary cybersecurity best practices for organizations in the health care industry. States have also begun to issue regulations specifically related to cybersecurity, which may differ or conflict from state to state. In October 2017, the NAIC adopted the Insurance Data Security Model Law, which creates rules for insurers and other covered entities addressing data security, investigation and notification of breaches. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches and notifying regulators of a cybersecurity event. As the model law is intended to serve as model legislation only, states will need to enact legislation for the model law to become mandatory and enforceable. To date, 21 states have enacted some form of the model law.

Over the past several years, the federal government has increasingly focused on the cybersecurity requirements applicable to government contractors, including enhanced guidance and regulation. These include compliance with the Privacy Act of 1974, the Defense Federal Acquisition Regulation Supplement cybersecurity requirements, the Cybersecurity Maturity Model Certification (going into effect over the next four years and based on the National Institute of Standards and Technology ("NIST") standards), the Federal Information Security Modernization Act and the White House's 2021 Executive Order on Improving the Nation's Cybersecurity.

In addition, we are or may become subject to international laws, rules and regulations governing privacy, data protection, information security, AI and wider data regulation, such as the European Union's General Data Protection Regulation ("GDPR"), Artificial Intelligence Act and Digital Operational Resilience Act, which can be more stringent than those in the United States. Complying with these laws may increase our compliance costs or necessitate changes to our business activities, and any failure to comply could result in regulatory investigations, fines or other penalties. Some non-U.S. jurisdictions are also instituting data residency regulations requiring that data be maintained within the respective jurisdiction or otherwise restricting transfer of personal data across borders unless specified regulatory requirements are met.

15

Consumer Protection Laws

We engage in direct-to-consumer activities and are therefore subject to federal and state regulations applicable to electronic communications and other consumer protection laws and regulations