Company: OXBRW
Filing Date: 2025-03-26
Form Type: 10-K
Source: 0001641172-25-000736
Chunk: 333

Company: OXBRIDGE RE HOLDINGS Ltd
Filing Date: 2025-03-26
Form: 10-K
Item: Item 1
Chunk 333
---
ain an Enterprise Risk Management (“ERM”) program to identify and respond to the most critical risks to our business,
including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at
least annually by our Executive Management Team as part of our ERM program. In response to such assessments, controls are embedded into
our processes and technology by our Executive Management Team to seek to mitigate risks to our systems and processes from cybersecurity
incidents. We continuously evaluate whether we have adequate controls in place utilizing a risk-based approach that tailors and applies
best practice from various industry standard IT Management frameworks such as Information Technology Infrastructure Library (ITIL), Control
Objectives for Information Technologies (COBIT), National Institute of Standards and Technology CyberSecurity Framework, and ISO/IEC
27001.

Our
daily operations are continuously monitored. We monitor traffic traversing our computer networks and have implemented IT controls and
processes to secure our business applications and prevent unauthorized access to or the loss of sensitive data. Our controls include
the use of multiple encryption layers for data in transit and at rest, multi-factor authentication, data classification, and data loss
prevention. We plan to assess the adequacy of our cybersecurity IT controls through annual cybersecurity vulnerability testing.

    27

We
maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third-party vendors. Third-party vendors
that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies,
are evaluated to assess their performance across several domains, including data security and operations management. We seek to maintain
effective communication with our third-party vendors to facilitate timely notification of cybersecurity incidents that might impact the
Company. We also independently monitor reputable cybersecurity publications for notifications about vulnerabilities in widely used software
libraries, APIs, and other generally available technologies upon which our third-party vendors’ products might rely.

Although
risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially
affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from
time to time, experience threats and security incidents related to our and our third-party vendors’ information systems. For more
information, please see “Item 1A. Risk Factors - Increased Information Technology (“IT”) security threats and more
sophisticated computer crime could pose a risk to our systems, networks, and services.”

ITEM
2 PROPERTIES