Company: FRFXF
Filing Date: 2025-10-09
Form Type: F-10/A
Source: 0001104659-25-098335
Chunk: 83

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-09
Form: F-10/A
Chunk 83
---
 technologies, based on existing consumer protection laws. Finally, there are several legislative proposals pending before the U.S. Congress and various state legislative bodies concerning privacy. Privacy regulation is an evolving area of state and federal regulation, which requires us to continue to monitor developments.

#### Cybersecurity
In 2017, the NAIC adopted an Insurance Data Security Model Law that establishes minimum cybersecurity requirements applicable to licensed insurance companies and licensed insurance intermediaries. Among other requirements, the Insurance Data Security Model Law requires licensees to maintain an information security program based on a cybersecurity risk assessment, establish a written incident response plan, provide an annual certification of compliance to state insurance regulators, and investigate and notify state insurance regulators regarding cybersecurity events. As of August 8, 2025, the NAIC reports that 28 jurisdictions have adopted a version of the Insurance Data Security Model Law or portions thereof and adopting legislation or rulemaking was pending in one jurisdiction. The New York Department of Financial Services already has a similar cybersecurity regulation in effect and adopted a number of substantial amendments to the regulation in November 2023 that further heighten its cybersecurity requirements, including with respect to governance, incident response and reporting, and implementing certain security controls. Most of the new requirements are now in effect, with the final remaining requirements set to take effect on or before November 1, 2025. Separately, Massachusetts also has regulations in place that require businesses to maintain a cybersecurity program that meets certain minimum requirements. See also “Risk Factors — Risk Factors Relating to Our Business — A disruption of our information technology systems could significantly affect our business.”

In March 2022, the U.S. government passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“

### CIRCIA
”), which will require companies deemed to be part of U.S. critical infrastructure to report any “substantial” cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (“

#### CISA
”) of the U.S. Department of Homeland Security within 72 hours and ransomware payments within 24 hours. On April 4, 2024, CISA published proposed regulations, defining the scope of application and details around these reporting obligations. The proposed regulations would apply to any entity operating in one of the 16 critical infrastructure sectors (including the financial services sector) as designated by the President that either (i) exceeds the industry specific small business size standard defined under the Small Business Administration’s small business size regulations (the “size-based criterion”), or (ii) falls within one or more specific critical