Company: HUM
Filing Date: 2025-03-07
Form Type: DEF 14A
Source: 0001193125-25-048976
Chunk: 36

Company: HUMANA INC
Filing Date: 2025-03-07
Form: DEF 14A
Chunk 36
---
 include:

| • |     | Employing a qualified Chief Information Security Officer |

| • |     | Maintaining tools to identify malicious cyber activity |

| • |     | Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. |

| • |     | Providing annual cybersecurity training to our associates |

| • |     | Testing our associates’ knowledge through internal phishing simulations |

| • |     | Hosting a multi-day learning event annually during National Cyber Security Awareness Month, an opportunity for all of our associates and contractors to learn more about cybersecurity awareness, hear from industry and cyber-crime experts, and collaborate with colleagues |

| • |     | Reporting data breaches, as required by law, to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), and various state agencies; our reports are publicly available, free of charge, and can be obtained through the OCR Portal at https://ocrportal.hhs.gov/ocr/breach |

| • |     | Maintaining a program to identify cybersecurity risks associated with certain third-party vendors, which is one component of an overall vendor risk management capability |

To further reinforce our accountability in this area and verify compliance with state laws and regulations, we engage independent third-party firms to perform annual audits of the Service Organizational Controls 2 (SOC 2) of enterprise claims platforms within the following Trust Services Criteria: availability, confidentiality, security and processing integrity. Additionally, our IT infrastructure and information security management systems are both internally and externally audited. These audits have resulted in us receiving industry-recognized certifications from organizations such as the Health Information Trust Alliance (HITRUST certification), derived from the ISO/IEC 27000 family of standards; National Institute of Standards and Technology (NIST) compliance; and

| 36 |     | Humana | 2025 Proxy Statement • Humana’s Impact |

Payment Card Industry Data Security Standards (PCI-DSS)certification. These objective certifications and compliance standards provide transparency and substantiate the efficacy of our world-class security program. For the Environment We believe that putting health first for our members, patients and employees is inherently connected to the health of our planet and environment. The wellbeing of individuals and the communities we serve cannot be achieved without considering the broader ecosystem where we all live. We continue to invest our time and our resources where we can yield the most environmental impact, finding new ways to drive energy efficiencies, embrace renewable energy sources, improve our vehicle