Company: HUM
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000049071-25-000007
Chunk: 147

Company: HUMANA INC
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 147
---
 cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.

Governance

As part of its overall responsibility for oversight of our enterprise risk management, our Board of Directors reviews material risks to our Company, including risks from cybersecurity threats. The Board has designated our Audit Committee and Technology Committee with joint oversight over our information technology internal controls, cybersecurity, business continuity and disaster recovery programs.  

Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors.  Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our 

35

Chief Information Officer, who is in turn responsible for the management of Humana’s data and information technology risks more generally. Our Chief Information Officer is a senior executive with more than two decades of experience leading technology teams in large, regulated industries. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.  Among our cybersecurity and risk teams, we utilize established governance mechanisms to enable a transparent and holistic approach to cybersecurity risk management, and the evaluation and remediation of cybersecurity incidents. These processes enable cross-functional engagement from our enterprise information protection, enterprise risk management, enterprise compliance, information technology, legal, privacy, and data governance teams.  As a key component of this governance framework, the Audit Committee and Technology Committee also receive regular updates regarding our cybersecurity program and cybersecurity incidents from our Chief Information Security Officer.