Company: OXBRW
Filing Date: 2025-03-26
Form Type: 10-K
Source: 0001641172-25-000736
Chunk: 432

Company: OXBRIDGE RE HOLDINGS Ltd
Filing Date: 2025-03-26
Form: 10-K
Item: Item 1A
Chunk 432
---
 Response Standard or that otherwise necessitates regulatory disclosure
because of its materiality, will be communicated by the CIRT to the Board within specified timeframes. All cybersecurity incidents, will
be evaluated by our CIRT to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting
this assessment and responding to an incident, the CIRT Team may utilize the services of third-party consultants. Third-party consultants
may be engaged to assist with the identification of the source of any cybersecurity incidents, remediation and recovery from such incident,
and the refinement of cybersecurity controls to avert similar future cybersecurity threats and incidents.

Cybersecurity
user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and
the Company against cybersecurity threats. Novel cybersecurity threats to the Company that are identified  are communicated
to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.

Risk
Management Strategy

We
maintain an Enterprise Risk Management (“ERM”) program to identify and respond to the most critical risks to our business,
including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at
least annually by our Executive Management Team as part of our ERM program. In response to such assessments, controls are embedded into
our processes and technology by our Executive Management Team to seek to mitigate risks to our systems and processes from cybersecurity
incidents. We continuously evaluate whether we have adequate controls in place utilizing a risk-based approach that tailors and applies
best practice from various industry standard IT Management frameworks such as Information Technology Infrastructure Library (ITIL), Control
Objectives for Information Technologies (COBIT), National Institute of Standards and Technology CyberSecurity Framework, and ISO/IEC
27001.

Our
daily operations are continuously monitored. We monitor traffic traversing our computer networks and have implemented IT controls and
processes to secure our business applications and prevent unauthorized access to or the loss of sensitive data. Our controls include
the use of multiple encryption layers for data in transit and at rest, multi-factor authentication, data classification, and data loss
prevention. We plan to assess the adequacy of our cybersecurity IT controls through annual cybersecurity vulnerability testing.

    27

We
maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third-party vendors. Third-party vendors
that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies,