Company: NODK
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0001174947-25-000304
Chunk: 695

Company: NI Holdings, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1C
Chunk 695
---
Item 1C.Cybersecurity

Cybersecurity risk is an important and evolving
focus for the Company. The increased sophistication and activities of unauthorized parties attempting to access our systems is an ever-present
risk. Cybersecurity risks may also arise from human error, fraud, or malice on the part of employees or third parties who have authorized
access to our systems or information.

Our information security program is directly managed by a dedicated Director
of Information Systems, whose team is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.
Company employees are periodically required to affirm their understanding of several policies and standards, including those related to
cybersecurity. Our cybersecurity strategy is primarily focused on network security, data security, vulnerability management, incident
management, and disaster recovery. We utilize internal resources as well as third-party consultants and vendors to periodically conduct
cybersecurity vulnerability testing, facilitate employee training, perform system assessments, and provide recommendations based on industry
best practices.

The Director of Information Systems provides periodic reports to our ERMC
related to cybersecurity risks and threats, the status of projects to strengthen our information security systems and controls, assessments
of the information security program and related third-party service providers, and the emerging threat landscape. The ERMC provides oversight
and support related to our cybersecurity program and consists of our Chief Executive Officer, Chief Financial Officer, Director of Information
Systems, and other appropriate members of senior management who possess the relevant expertise to assess and manage cybersecurity risks
as part of the broader enterprise risk management process. Periodic reports are also provided to appropriate members of senior management
that include information regarding prevention, detection, mitigation, and remediation efforts related to cybersecurity incidents.

Our Chief Executive Officer and Director of Information Systems also provide
periodic reports to the Audit Committee of the Board of Directors regarding ERMC activities and assessments, including those related to
cybersecurity and cybersecurity incidents. The Audit Committee of the board oversees our risk management program, which focuses on the
most significant risks we face in the short-, intermediate-, and long-term timeframes. Audit Committee meetings include discussions of
specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management
on our enterprise risk profile on an annual basis.

As of the date of this 2024 Annual Report, we are not aware of any risks
from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business
strategy, results of operations, or financial