Company: HIG-PG
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000874766-25-000023
Chunk: 988

Company: HARTFORD INSURANCE GROUP, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 988
---
 Model Law. Our legal team monitors the status of new cybersecurity regulations, including notification requirements. To the best knowledge of Management, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the Company's risks related to cybersecurity, see Part I, Item 1A, — Risk Factors for the risk factor "Our businesses may suffer and we may incur substantial costs if we are unable to access our systems and safeguard the security of our data in the event of a disaster, cyber breach or other information security incident."  From a governance perspective, senior members of our Enterprise Risk Management, Information Protection and Internal Audit functions provide detailed, regular reports on cybersecurity matters to the Board of Directors, primarily through the Audit Committee, which oversees controls for the Company's major risk exposures and has principal responsibility for oversight of cybersecurity risk, and the Finance, Investment and Risk Management Committee ("FIRMCo"), which oversees business risk related to cyber insurance products. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.The Audit Committee is provided with updates on technology and cybersecurity risks at least four times annually, including annual reviews of the Company's cybersecurity program and technology risks and controls, and bi-annual updates on operational risks (in spring and fall). Given its importance, the full Board of Directors is invited to attend the annual cybersecurity program update and time is reserved at each Audit Committee meeting for cybersecurity technology matters that warrant discussion between the standing sessions. In addition, Enterprise Risk Management provides FIRMCo an assessment of cyber insurance risk once per year. The Audit Committee, FIRMCo and the full Board of Directors are apprised of developments in the external environment and business strategies that present additional potential cyber risk exposure to the Company on an as-needed basis. As a result, cybersecurity and cyber risk are typically discussed more frequently than the annual minimum requirements.The Company has established an Executive Privacy & Security Council ("EPSC") that meets semi-annually. The EPSC consists of a cross-functional senior leaders, including the Chief Information Officer ("CIO"), the Chief Information Security Officer ("CISO"), the Chief Risk Officer ("CRO"), the Chief Privacy Officer ("CPO") and General Counsel, among others. The EPSC receives a monthly written executive briefing on topics, and with metrics related to cybersecurity, including incident prevention