Company: CRD-A
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030894
Chunk: 178

Company: CRAWFORD & CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 178
---
 Company.

We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes created by artificial intelligence). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework. 

We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance, including review of past cybersecurity incidents in order to address known vulnerabilities. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks. 

We are also in the process of simplifying our technology landscape and implementing several new cybersecurity technologies that will help improve the management of cybersecurity risks and threats. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial (including no related penalties and settlements).