Company: AFGC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001042046-25-000011
Chunk: 136

Company: AMERICAN FINANCIAL GROUP INC
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 136
---
urchases information security risk insurance from a third-party insurer that provides protection against the potential losses arising from a cybersecurity incident.AFG continues to integrate assessing cybersecurity threat risks associated with its use of third-party service providers, generally at the initial engagement or renewal of the relationship. When conducting these assessments, AFG’s Enterprise Information Security Group (“EISG”) considers the risk profile of the vendor or supplier, assesses security controls with the third parties and engages in contractual review to ensure appropriate security controls are in place.AFG describes whether and how risks from identified cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition in its risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference in this Item 1C.Like others in the insurance industry, AFG experiences cyber-attacks and other attempts to gain unauthorized access to its systems on a regular basis and anticipates continuing to be subject to such attempts. Over the last three years, AFG has not experienced any material adverse events and has not paid any penalties or settlements related to an information security breach.

Governance

AFG’s Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the full Board of Directors receives and at least quarterly, the Audit Committee receives an overview from the Chief Information Security Officer (“CISO”) or another senior member of the EISG of the Company’s cybersecurity threat risk management and 

26

Table of Contents

strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, incident response planning and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, materials including a cybersecurity scorecard and other information indicating current and emerging material cybersecurity threat risks and describing the Company’s ability to mitigate those risks are provided. Members of the Board also regularly receive educational materials and engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to AFG’s cybersecurity risk management and strategy programs.AFG has designed its ERM program to reinforce the way the Company operates its business and reflects its culture, organizational structure and risks. The AFG Enterprise Risk Committee (“ERC”), consisting of AFG’s Chief Administrative Officer and Chief Human Resources Officer, AFG’s Chief Financial Officer, AFG’s General Counsel and Great American’s President, oversees the ERM process including risk identification, risk impact and mitigation