Company: PRI
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029882
Chunk: 398

Company: Primerica, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 398
---
Risk Management and Strategy

Primerica has processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats which are integrated into Primerica’s enterprise risk management system. Primerica’s enterprise risk management and internal audit functions conduct regular assessments and audits of risks from cybersecurity threats and report the results to the Board of Directors at least quarterly. The Board considers cybersecurity risk as part of its business strategy, risk management, and financial oversight.

Primerica institutes a three-lines-of-defense model for information security risk assurance, in which management owns the risk, our enterprise risk management team assesses the risk and oversees compliance with internal guidelines and policies, and our internal audit team reviews the effectiveness of the first two lines of defense. Management works with external assessors, consultants, auditors, and other third parties from time to time in conducting maturity and technical assessments. 

Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company’s policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy. 

We have an incident response plan designed to help us monitor the prevention, detection, mitigation, and remediation of information security incidents. The incident response plan documents the roles and responsibilities of Primerica personnel in responding to information security incidents, including the process by which the Chief Information Security Officer, the Chief Information Officer, senior management, and the Board is informed about such incidents.