Company: CRD-A
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030894
Chunk: 17

Company: CRAWFORD & CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 17
---
, and financial condition.

Malicious technology-related events, such as cyberattacks, computer hacking, computer viruses, ransomware, worms and other destructive or disruptive software and other attempts to gain access to confidential or personal data, denial of service attacks and other malicious activities are becoming increasingly diverse and sophisticated and the incidence of these events is on the rise worldwide and highlights the need for continual and effective cybersecurity awareness and education. Our business, which involves the collection, use, transmission and other processing of data, makes us and our clients and business partners attractive targets of hackers, denial of service attacks, malicious code, phishing attacks, ransomware attacks, and other threat actors, including malicious insiders (such as employees and prior employees), which have resulted in security incidents. Types of cybersecurity incidents may include unauthorized access, misuse, loss, corruption, inaccessibility, or destruction of data (including personal, confidential and sensitive data), unavailability of services, or other adverse events. 

Separately, in the event of a cyberattack we may not be able to consistently maintain active communications between our various global operations and with our clients due to disruptions in telecommunication networks and power supplies. Any significant failure in our ability to communicate could result in a disruption in business, which could hinder our performance and our ability to complete projects on time. Significant failure of our equipment or systems, or any major disruption to basic infrastructure like power and telecommunications in the locations in which we operate, resulting from a cybersecurity incident, could impede our ability to provide services to our clients, have a negative impact on our reputation, cause us to lose clients, and adversely affect our results of operations.

In the past three years, we have faced cyberattacks, and we expect to continue to face cyberattacks in the future. Some of these attacks have been successful, although none have been material. We have made investments in our information security policies, procedures and technical controls and routinely engage a third party to assess the maturity of our information security program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. However, we do not believe it is possible to protect our systems or third-party systems against every attempt at a malicious breach due to the increasing sophistication and frequency of such attacks. All employees receive security awareness training including communication of processes for reporting a potential security incident. We have a robust Cyber Incident Response Plan in place which provides a documented framework for handling high severity security and privacy incidents and facilitates coordination across multiple parts of the Company and with external expertise when necessary. Additionally, we have existing procedures to