Company: CRD-A
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030894
Chunk: 31

Company: CRAWFORD & CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1B
Chunk 31
---
 updates to the Audit Committee quarterly, including progress on the cybersecurity initiatives, risk trends and scores, and any cybersecurity incidents. Executive leadership and the Board of Directors are regularly informed and updated on any potentially material incidents.We also created a SCRDC composed of members from cybersecurity, privacy, legal, audit, and finance teams. This committee's objective is to review and discuss the nature of cybersecurity and privacy incidents and determine impact and materiality. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO, CPO, CIO, and VP of Global IT Security. Our security, privacy, and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. These leaders have relevant degrees and certifications, including Certified Information Systems Auditor, Certified Information Systems Security Professional, Fellow of Information Privacy, and Certified Information Privacy Professional. As described above, we have experienced professionals in the key roles of the CISO, CPO, CIO, and VP of Global IT Security. The cybersecurity and privacy offices are responsible for incident reporting and management, which includes cybersecurity threats. The Incident Response team, comprising key cross-functional professionals and stakeholders globally, meets weekly and as needed to identify, respond, contain, and coordinate events where activities threaten the security, confidentiality, integrity, and availability of our information, including client information and information systems. Once an event materially impacts systems or data, these cross-functional professionals and stakeholders evaluate the incident using key factors (e.g., type and scope of information impacted, systems impacted, reputational impact) and promptly inform senior leadership, the Audit Committee and the Board of Directors. Further, we may consult outside counsel or external advisors given the circumstances and situation (e.g., client, controls, location, or regulatory landscape). 

ITEM 2.	PROPERTIES

 As of December 31, 2024, we leased 202 office locations under various leases with varying terms. For additional information on our significant operating leases and subleases, see Note 6 "Lease Commitments" of our accompanying consolidated financial statements included in Item 8 of this Annual Report on Form 10-K. Other office locations are occupied under various short-term rental arrangements. We generally believe that our office locations are sufficient for our operations and that, if it were necessary to obtain different or additional office locations, such locations would be available at times, and on commercially reasonable terms, as would be necessary for the conduct of our business. No