Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 310

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 16K
Chunk 310
---
 disrupt our business, damage our reputation and cause losses."

In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. These engagements cover a range of risk mitigation activities such as threat detection, penetration testing and red/purple team cyber-attack simulations.

We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of such third-party service providers, including in relation to information security, particularly for personal information.
These controls include contractual requirements to meet certain information security and testing requirements, alongside ongoing oversight procedures.

Management has responsibility to manage risk and bring to the Board’s attention the most material near-term and long-term risks to the Company. The Company’s CISO leads management’s assessment and management of cybersecurity risk and is responsible for defining the Framework, and for establishing and maintaining security policies, standards and guidelines for group-wide applicability. Our Company CISO has extensive experience in IT and cybersecurity in particular, spanning over 25 years within multiple industries, including financial services and insurance, including CISO roles at PE owned companies.

The Board is actively engaged in overseeing and reviewing the Company’s strategic direction and objectives, taking into account, among other considerations, the Company’s risk profile and related exposures, as part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. TheRisk Committeereviews, on behalf of the Board, at least once annually, the Group’s cybersecurity program, its effectiveness, related exposures and risks, including actions underway or planned to reduce these risks.
The CISO presents to the Risk Committee at least once annually, and the Board receives updates on operational risks, including cybersecurity matters, at its regular quarterly meetings from the Group Chief Operating Officer, alongside second-line oversight updates from the Group Chief Risk Officer.

On the recommendation of the Risk Committee, the Board reviews and approves the Group Information Security and Risk Management Policy on an annual basis and oversees our annual enterprise risk assessment on at least an annual basis to assess key risks within the business, including security and technology risks and cybersecurity threats.

For further information regarding the Company’s cybersecurity framework and associated governance procedures, please refer to Item 4, “ Business Overview - Regulatory Matters - Privacy & Cybersecurity Laws.”

For further information on our risk management strategy, refer to Item 4, “ Business Overview - Risk Management - Risk Management Strategy.”

Table of Contents Contents

PART III