Company: AFGC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001042046-25-000011
Chunk: 135

Company: AMERICAN FINANCIAL GROUP INC
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 135
---
Table of Contents

Item 1C. Cybersecurity

Risk Management and Strategy

AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for “cyber-attacks,” “ransomware,” “phishing,” “hacking” and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.As discussed below, AFG’s enterprise risk management (“ERM”) process considers cybersecurity threat risks alongside other company risks as part of the overall risk assessment process.AFG has adopted the National Institute of Standards and Technology (“NIST”) Cybersecurity framework which provides a comprehensive method for developing a flexible, repeatable, performance-based and cost-effective approach to identifying and managing cybersecurity risks. The Company uses the framework to assess and improve its security posture.AFG utilizes a variety of techniques to provide for the availability of critical data and systems, maintain regulatory compliance, manage its material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents including, but not limited to, the following:•Conducts regular phishing testing of all employees and all members of the Board of Directors;•Utilizes full-desk encryption on all Company laptops and desktops;•Maintains a defense in depth security control strategy that is tested against high risk threats such as ransomware and other trending attack vectors;•Performs annual security awareness training and other routinely scheduled educational programming for employees;•Validates compliance with internal data security controls through the use of security monitoring utilities and internal and external audits;•Performs self-assessments measured against industry-leading cybersecurity frameworks for standards, guidelines and best practices, including the NIST cybersecurity framework;•Regularly scans external websites and internal applications;•Engages an external third-party to conduct an annual penetration test consisting of advanced adversarial attacks against company systems and from which findings are investigated, ranked by risk level and tracked through appropriate mediation levels;•Utilizes user protections including stringent password requirements, two-factor authentication, and timed logoffs;•Conducts regular network and endpoint monitoring;•Performs regular tabletop exercises, utilizing a third-party data security firm as a facilitator, to simulate a response to a cybersecurity incident where the Company uses the findings to improve its processes and technologies; and•P