Company: FRFXF
Filing Date: 2025-03-14
Form Type: F-4
Source: 0001104659-25-024010
Chunk: 74

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-14
Form: F-4
Chunk 74
---
 Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), which will require
companies deemed to be part of U.S. critical infrastructure to report any “substantial” cybersecurity incidents to the Cybersecurity
and Infrastructure Security Agency (“CISA”) of the US Department of Homeland Security within 72 hours and ransomware
payments within 24 hours. On April 4, 2024, CISA published proposed regulations, defining the scope of application and details around
these reporting obligations. The proposed regulations would apply to any entity operating in one of the 16 critical infrastructure sectors
(including the financial services sector) as designated by the President that either (i) exceeds the industry specific small business
size standard defined under the Small Business Administration’s small business size regulations (the “size-based criterion”),
or (ii) falls within one or more specific critical infrastructure sectors or subsectors, including the “financial services
sector” (the “sector-based criterion”). CISA currently considers the insurance business to be included in “financial
services” for purposes of designated critical infrastructure and Fairfax and/or certain insurance subsidiaries thereof may become
subject to CIRCIA requirements – including reporting requirements.

For reporting purposes,
the proposed regulations define a substantial cyber incident to include: (i) incidents that lead to the substantial loss of confidentiality,
integrity, or availability of systems; (ii) serious impact on the safety and resiliency of operational systems and processes; (iii) disrupt
the ability to engage in business operations or deliver services; or (iv) any unauthorized access to systems or nonpublic information
that is facilitated or caused by a compromise of a third-party data hosting provider (e.g., cloud provider) or a supply chain compromise.
The proposed regulations also establish record retention requirements for background material supporting the filing of the report. The
proposed regulations would also give CISA power to subpoena companies it believes are not reporting a substantial cybersecurity incident
or ransomware. If CISA believes a company is not appropriately responding to a subpoena, it could refer the matter to the Department
of Justice. CIRCIA requires that the final rules be published within 18 months of being proposed, meaning the rules must be
finalized on or before October 4, 2025.

Regulation of Holding Company Systems

While insurance in the United States
is regulated primarily on a legal-entity basis, the NAIC has increased its focus on risks presented by an insurer’s holding company
system. In 2010, the