Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 309

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 16K
Chunk 309
---
 information security and cyber risks are assessed to form the basis for determining how risks should be managed. After information security and cyber controls are implemented, they are regularly monitored and evaluated to determine whether the controls are implemented correctly, operate as intended, produce the desired outcome, and continue to comply with laws, regulations and contractual requirements. Monitoring helps to maintain a dynamic understanding of the Group’s risk profile and identify control deficiencies which require remediation actions.

As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, employee phishing testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all employees, to undertake data protection and cybersecurity training and compliance programs annually.

Table of Contents Contents

Where possible, with respect to our cyber risk management processes, controls are implemented with a corresponding performance scale which is used as the basis for establishing monitoring via Key Risk Indicators (“ KRIs”). KRIs are measured against the acceptable level of variance in performance relative to the achievement of control objectives and indicate whether controls are adequately addressing risk and whether risks are changing over time. KRIs that fall outside of pre-established thresholds trigger a more thorough management review and assessment, and where appropriate, any necessary adjustments to controls. Control deficiencies that result in exposures that exceed tolerance will be subject to a monitored mitigation plan with an agreed timeline to reduce residual risk to within the tolerance; and included in risk reporting. In such a case, the risk is implicitly temporarily accepted while mitigation actions progress. The development and ownership of an appropriate response is determined by relevant first line stakeholders in consultation with the Group Chief Information Security Officer (“ CISO”). The action plan should be proportionate to the level of exposure and include defined actions aligned to the underlying causes.

In some cases, it might be determined that the exposure exceeds risk tolerance and cannot be brought within acceptable levels through any combination of mitigation or risk transfer. In this case, the applicable business function owner will consult with the CISO to determine the best course of action (e. g., through risk avoidance, an exception process, or increased security requirements for the relevant system/process). Exceptions and risk avoidance circumstances should be rare and will be recorded and reported to the Group Executive Committee. Notably, risk avoidance is not the same as ignoring a risk. See "Risk Factors - A failure in our data security and/or technology systems or infrastructure or those of third parties, including those caused by security breaches or cyber-attacks could