Company: AFGC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001042046-25-000011
Chunk: 137

Company: AMERICAN FINANCIAL GROUP INC
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 137
---
 strategies. Each member of the ERC directly reports to AFG’s Co-CEOs. On a day-to-day basis, the Company’s ERM process is overseen by an AFG Enterprise Risk Officer, who regularly meets with senior leaders, including the CISO, representing key areas throughout the organization. Cybersecurity risk has been identified as a significant risk monitored under the ERM program. In addition, Ms. Murray, one of AFG’s independent Directors, completed the National Association of Corporate Directors’ Cyber-Risk Oversight Program and received the CERT Certificate in Cybersecurity Oversight issued by the Software Engineering Institute at Carnegie Mellon University.AFG has also adopted a Security Incident Response Plan (“SIRP”) that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. The AFG CISO leads and facilitates the SIRP team, which also includes AFG’s Chief Administrative Officer and Chief Human Resources Officer, AFG’s Chief Financial Officer, AFG’s Chief Information Officer, AFG’s General Counsel and Great American’s President and its General Counsel.The SIRP provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. The incident response plan is reviewed, updated and tested at least annually. The SIRP covers the major phases of incident response process, including preparation; detection and analysis; containment and investigation; where required, notification to federal or state regulators; eradication and recovery; and incident closure and post-incident analysis.AFG’s cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional officers who report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology (“IT”) experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control®, Certified Information Security Manager, ITL certification and others. The CISO also holds a master’s degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and