Company: AXS-PE
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001214816-25-000056
Chunk: 269

Company: AXIS CAPITAL HOLDINGS LTD
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 269
---
, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, and when detected by security tools or third parties, may not always be immediately understood or acted upon. Although the Company has implemented cybersecurity policies, procedures and controls intended to mitigate these risks and the likelihood of these risks occurring may not be high, if these risks are realized the impact could be material, such as in the event of a material cybersecurity incident.

Additionally, in Item 1A, 'Risk Factors' we discuss forward-looking cybersecurity risks that could have a material impact on us. Our disclosures in Item 1A should be read in conjunction with this Item 1C. 

54

Management & Board Governance

With over 30 years of industry cybersecurity experience, the Company’s Chief Information Security Officer ("CISO") is the member of the Company’s management team with primary responsibility for the development, operation, and maintenance of the Company’s information security program. The CISO supervises the Company’s cybersecurity team, facilitates the incident response plan and acts as the liaison to the Company’s executive management team, including relaying strategies, resource requests and incident updates. The Company’s security event monitoring and detection capabilities are performed by our Cybersecurity team and third parties through the use of processes and tooling. Cybersecurity incidents are responded to by a multi-disciplinary Incident Response team and if appropriate, escalated to our Cybersecurity Disclosure Subcommittee, Executive Management, and the Board. The level of escalation will vary depending on the severity and scope of the cyber incident. In the event of a severe cyber incident, the CISO will escalate to the relevant subcommittee to determine the course of action. All relevant roles are trained on their responsibilities regularly. The Board, along with the Risk and Audit Committees of the Board, oversees our information security program. In 2024, our Board and Risk and Audit Committees received periodic updates throughout the year on cybersecurity matters, and these updates are part of their standing agendas. These updates include reports regarding items such as cybersecurity strategies, program effectiveness, key risks and performance metrics related to the Company’s information security program and the Company’s mitigating controls.

The Company has an enterprise risk management function that oversees the identification, prioritization, and mitigation of the Company’s enterprise risks, and cybersecurity is a risk category addressed by that function. The Company uses governance, risk and compliance tools to assess, identify and manage its cybersecurity risks.