Company: AXS-PE
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001214816-25-000056
Chunk: 268

Company: AXIS CAPITAL HOLDINGS LTD
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 268
---
ITEM 1C.    CYBERSECURITY

Risk Management and Strategy

The Company’s information risk management program is designed to protect the confidentiality of nonpublic, sensitive information and the integrity and availability of our information systems. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. We have designed our enterprise-wide information security program consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.Key components of our cybersecurity risk management program include:•risk assessments designed to help identify cybersecurity risks to our critical systems, information, and services.•a security team principally responsible for managing (1) our cybersecurity policies & risk assessment processes, (2) security architecture and engineering, (3) identifying vulnerabilities, managing remediation, and testing of our security controls, and (4) our cybersecurity monitoring & incident response.•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.•managing a cybersecurity awareness and training program that covers employees and contractors who access internal systems.•a cybersecurity incident response plan that includes procedures for responding to various types of cybersecurity incidents and tested through periodic tabletop exercises.•a third-party security risk assessment team, which is involved with identifying, assessing, and controlling risks that occur due to interactions with third parties including vendors and procurement.•restricted physical access to critical areas, servers, and network equipment.•support of our business continuity and disaster response plans.

Impact of Material Risk  

To date, no cybersecurity incidents have materially impacted the Company, including the Company's business strategy, results of operations, or financial conditions. However, financial institutions face risks from threat actors that focus on attacks of critical information systems infrastructure assets, disruption to operations, and ransomware groups that steal data, encrypt systems, and demand a payment. The Company relies on third-party software, third-party hardware, and third-party vendors to manage critical aspects of our operations which may be at risk of cybersecurity threats. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls