Company: CRD-A
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030894
Chunk: 30

Company: CRAWFORD & CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1B
Chunk 30
---
 to cybersecurity risks that are deemed to materially affect the Company.We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes created by artificial intelligence). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework. We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance, including review of past cybersecurity incidents in order to address known vulnerabilities. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks. We are also in the process of simplifying our technology landscape and implementing several new cybersecurity technologies that will help improve the management of cybersecurity risks and threats. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial (including no related penalties and settlements). 

14

Cybersecurity GovernanceOur global cybersecurity and privacy program is managed by our Chief Technology and Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer (“CPO”), and Chief Information Officer (“CIO”). We have also established a Cybersecurity and Privacy Council, which comprises our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs. The Board of Directors provides oversight and has designated primary responsibility to the Audit Committee who oversees our information security programs including cybersecurity and is actively involved in monitoring the progress of key cybersecurity initiatives. The CISO manages the cybersecurity program in collaboration with the CIO, CPO, and our business leaders. The CISO provides