Company: CRD-A
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030894
Chunk: 29

Company: CRAWFORD & CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1B
Chunk 29
---
None.

13

ITEM 1C.	CYBERSECURITYCybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our clients' and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security. We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management (“ERM”) program, which is managed by the Senior Vice President General Counsel. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite. Our ERM program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process when identifying and assessing material risks. Our ERM team collaborates with internal subject matter specialists, as necessary, to gather insights and report on the most significant risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to identify threats and improve our incident response plan.We identify and assess cybersecurity incidents based on multiple factors including information from previous events and incidents. The Cybersecurity Incident Response Team (“CSIRT”) categorizes events into four levels of severity with defined requirements to assess criticality. The CSIRT informs both our leadership as well as our SEC Cybersecurity Rules Disclosure Committee (“SCRDC”), Cybersecurity and Privacy Council and the Audit Committee of the Board on matters related