Company: HIG-PG
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000874766-25-000023
Chunk: 987

Company: HARTFORD INSURANCE GROUP, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 987
---
|Table of ContentsPart I - Item 1C. Cybersecurity

Item 1C. 

CYBERSECURITYThe Hartford has implemented an information protection program with established governance routines for assessing and managing risks. The Hartford employs a ‘defense-in-depth’ strategy that uses multiple security measures to protect the integrity of the Company's information assets. This ‘defense-in-depth’ strategy aligns to the National Institute of Standards and Technology Cybersecurity Framework, where controls are implemented throughout our environments to achieve the six categorical objectives of governance, identification, protection, detection, response and recovery. Our 'defense in depth' program uses several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber attacks, including, among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Hartford continues to monitor and enhance its framework to respond to evolving cyber threats and regulations for data privacy, including the European Union General Data Protection Regulation, the California Consumer Privacy Act and the New York Department of Financial Services Cybersecurity Regulation.We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities and external advisors to monitor the threat environment and to inform our security practices. In connection with regular assessments of third-party service providers, our information protection team performs an assessment of each vendor’s information security practices and protocols, including its readiness to protect against and respond to cybersecurity breaches. Third-party service providers are categorized in tiers depending on the significance of their operations to the Company’s business processes and risk assessments for vendors in the highest tier are completed periodically. With respect to cyber, we have procedures to verify each service provider’s information security controls, and each vendor completes a cyber questionnaire that also addresses their resiliency in the event of an intrusion to their systems. We proactively communicate with suppliers to understand mitigation steps taken when major cyber exposures are identified.We are executing on a multi-year roadmap to, among other things, further improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. A number of states where our insurance companies are domiciled, including Connecticut, have adopted the NAIC Insurance Data Security