Company: PRI
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029882
Chunk: 76

Company: Primerica, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 76
---
 Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company’s policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy.  We have an incident response plan designed to help us monitor the prevention, detection, mitigation, and remediation of information security incidents. The incident response plan documents the roles and responsibilities of Primerica personnel in responding to information security incidents, including the process by which the Chief Information Security Officer, the Chief Information Officer, senior management, and the Board is informed about such incidents.  

38

The Chief Information Security Officer leads the Company’s Incident Advisory Committee (“IAC”), which is notified in the event of high or medium severity incidents. The IAC includes representatives from information technology, legal, and often the impacted business unit. The Incident Response Team (“IRT”) consists of the IAC and a larger group of managers that is typically notified of more significant incidents. The IRT reports findings to management and the Board as necessary. Each IRT member has specific responsibilities related to his or her function at the Company. On a semi-annual basis, the IRT and management undertake facilitator-led trainings and simulations of information security incidents. Previous cybersecurity incidents have not materially affected the Company. For a discussion of risks to the Company related to cybersecurity threats, see “Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity”, which is incorporated herein by reference. Governance The Board of Directors has responsibility for oversight of risks from cybersecurity threats. The Board receives a quarterly report from the Chief Information Officer and Chief Information Security Officer on risks from cybersecurity threats and, under the Company’s incident reporting plan, the Board is informed by management of certain cybersecurity incidents as appropriate. In 2024, the Board participated in a facilitator-led training and simulation of an information security incident.  Primerica’s senior executive leadership is actively involved in managing material