Company: CI
Filing Date: 2025-03-14
Form Type: DEF 14A
Source: 0001739940-25-000015
Chunk: 27

Company: Cigna Group
Filing Date: 2025-03-14
Form: DEF 14A
Chunk 27
---
 components of the Company’s cybersecurity and privacy programs. Annually, the full Board reviews the Company’s cybersecurity program, including the threat landscape and related controls, and periodically conducts cybersecurity tabletop exercises.

The foundation of our cybersecurity program is our enterprise-wide security policies and standards. We examine our entire program annually with third parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the National Institute of Standards and Technology (NIST) and used by companies to assess and improve their ability to prevent, detect, and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization (ISO) 27001 and 27002 standards.

Artificial Intelligence Oversight

At The Cigna Group, we use artificial intelligence (AI) to support health care transformation by helping to enable the next generation of accessible, effective, affordable, and enhanced health care solutions. AI models can facilitate personalized solutions for individuals, inform earlier interventions, and simplify health care experiences. We do not view AI as a replacement for expert decisions made by patients’ physicians or employees at The Cigna Group. Given this, we consider most of the AI models we use as augmented intelligence, providing information to human experts for further consideration, in combination with many other factors evaluated in care and benefit administration decisions.

To ensure our practices and solutions are consistent with our commitment to health equity and to facilitate compliance with applicable laws and regulations, we have a dedicated team and governance structure in place, known as Enterprise Model Governance (EMG). Our EMG team oversees the development, deployment, and monitoring of AI models, which are driven by our Responsible AI Principles: validity and reliability; safety; privacy; fairness; transparency; and accountability. EMG is governed by the EMG Board, comprised of senior leaders from across the company, with representation from business, clinical, privacy, legal, internal audit, information protection, and other departments. The EMG Board oversees an enterprise-wide model approval and governance process for review of AI models in use or in development across the enterprise.

We also have established comprehensive governance processes for new capabilities, such as generative AI ("Gen AI"). Our AI Center of Enablement (AI COE) expands on EMG and brings together individuals from across our technology, privacy, data governance, security, legal, compliance, marketing, and other teams to evaluate and approve Gen AI