Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 862

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 862
---
 of credit issued. Although a portion of our reinsurance exposures are secured, the inability to collect a material recovery from a reinsurer could have a material adverse effect on our results of operations, financial condition and liquidity.

Item 1B. UNRESOLVED STAFF COMMENTS

None.

Item 1C. CYBERSECURITY 

Cybersecurity Strategy and Risk ManagementOur comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats. This program is an integral component of our enterprise risk management program. Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response Team. We undertake a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to (i) identity and access management; (ii) security awareness and training; (iii) security operations and monitoring; (iv) change 

33

management; (v) disaster recovery/business continuity; (vi) intelligence feeds; (vii) physical security; (viii) third-party vendor security reviews; (ix) vulnerability management/patching; and (x) cybersecurity incident reporting.We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization 27001 and 27002 standards. Our information protection policies and standards are informed by NIST 800-53b, moderate-level security control baseline requirements. To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises with leaders, stakeholders, subject matter experts and