Company: HIG-PG
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000874766-25-000023
Chunk: 322

Company: HARTFORD INSURANCE GROUP, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1
Chunk 322
---
 stockholders might consider to be desirable.Changes in accounting principles and financial reporting requirements could adversely affect our results of operations or financial condition.As an SEC registrant, we are currently required to prepare our financial statements in accordance with U.S. GAAP, as promulgated by the Financial Accounting Standards Board. Accordingly, we are required to adopt new guidance or interpretations which may have a material effect on our results of operations or financial condition that is either unexpected or has a greater impact than expected. For a description of changes in accounting standards that are currently pending and, if known, our estimates of their expected impact, see Note 1 - Basis of Presentation and Significant Accounting Policies of Notes to the Consolidated Financial Statements.

33

|Table of ContentsPart I - Item 1C. Cybersecurity

Item 1C. 

CYBERSECURITYThe Hartford has implemented an information protection program with established governance routines for assessing and managing risks. The Hartford employs a ‘defense-in-depth’ strategy that uses multiple security measures to protect the integrity of the Company's information assets. This ‘defense-in-depth’ strategy aligns to the National Institute of Standards and Technology Cybersecurity Framework, where controls are implemented throughout our environments to achieve the six categorical objectives of governance, identification, protection, detection, response and recovery. Our 'defense in depth' program uses several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber attacks, including, among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Hartford continues to monitor and enhance its framework to respond to evolving cyber threats and regulations for data privacy, including the European Union General Data Protection Regulation, the California Consumer Privacy Act and the New York Department of Financial Services Cybersecurity Regulation.We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities and external advisors to monitor the threat environment and to inform our security practices. In connection with regular assessments of third-party service providers, our information protection team performs an assessment of each vendor’s information security practices and protocols, including its readiness to protect against and respond to cybersecurity breaches. Third-party service providers are categorized in tiers depending on the significance of their operations to the Company’s business processes and risk assessments for vendors in the highest tier are completed periodically