Company: NODK
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0001174947-25-000304
Chunk: 267

Company: NI Holdings, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 267
---
 and/or agents, and integrating future acquisitions. The failure to manage our growth effectively could have a material
adverse effect on our business, financial condition, and results of operations.

We could be adversely affected by a future
unexpected business interruption involving our office buildings, operational systems and infrastructure, key external vendors, and/or
workforce.

Our business operations could be substantially
interrupted by flooding, snow, ice, wind, and other weather-related incidents, or from fire, pandemics, power loss, telecommunications
failures, terrorism, or other such events. Our business continuity plans may not sufficiently remediate all risks associated with future
significant business interruptions. Any damage caused by such a failure or loss may cause interruptions in our business operations that
may adversely affect our service levels and business.

Item 1B.Unresolved Staff Comments

None.

22 

Item 1C.Cybersecurity

Cybersecurity risk is an important and evolving
focus for the Company. The increased sophistication and activities of unauthorized parties attempting to access our systems is an ever-present
risk. Cybersecurity risks may also arise from human error, fraud, or malice on the part of employees or third parties who have authorized
access to our systems or information.

Our information security program is directly managed by a dedicated Director
of Information Systems, whose team is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.
Company employees are periodically required to affirm their understanding of several policies and standards, including those related to
cybersecurity. Our cybersecurity strategy is primarily focused on network security, data security, vulnerability management, incident
management, and disaster recovery. We utilize internal resources as well as third-party consultants and vendors to periodically conduct
cybersecurity vulnerability testing, facilitate employee training, perform system assessments, and provide recommendations based on industry
best practices.

The Director of Information Systems provides periodic reports to our ERMC
related to cybersecurity risks and threats, the status of projects to strengthen our information security systems and controls, assessments
of the information security program and related third-party service providers, and the emerging threat landscape. The ERMC provides oversight
and support related to our cybersecurity program and consists of our Chief Executive Officer, Chief Financial Officer, Director of Information
Systems, and other appropriate members of senior management who possess the relevant expertise to assess and manage cybersecurity risks
as part of the broader enterprise risk management process. Periodic reports are also provided to appropriate members of senior management
that include information regarding prevention, detection, mitigation, and