AmazonScience/document-haystack

1ITEM 1C | Cybersecurity2CYBERSECURITY RISK MANAGEMENT3AIG maintains a documented Information Security Program (the Program) that includes risk assessments regularly conducted by us 4and third-party experts to evaluate potential security threats that may have a negative impact on the organization, detect potential 5vulnerabilities and mitigate any identified security risks. The Program is informed by industry standards and frameworks and is 6designed to protect the confidentiality, integrity, and availability of AIG’s information assets and systems that store, process or transmit 7information. 8The AIG Chief Information Security Officer (CISO) provides oversight and direction for the Program, including adjustments in 9response to changes in technology, internal or external threats, business processes, and regulatory or statutory requirements and 10communicates the information security risk posture of AIG to senior management and the AIG Board of Directors. 11The Program includes the following key elements:12• Network, Systems and Data Security – The Company deploys technical and organizational safeguards that are designed to protect 13the Company’s networks, systems, and data from cybersecurity threats, including firewalls, intrusion prevention and detection 14systems, anti-malware functionality, and access controls.15• Threat and Vulnerability Management – The Company maintains a threat and vulnerability management program that leverages 16continuous threat intelligence to seek to proactively identify, assess, and mitigate evolving cybersecurity risks. This program 17incorporates vulnerability scanning, remediation management, bug bounty, penetration testing, and threat response capabilities, all 18designed to safeguard our information assets and ensure business continuity.19• Cybersecurity Incident Monitoring and Response – The Company has established and maintains incident response plans that 20address the Company’s response to a cybersecurity incident, utilizing a cross-functional approach.21• Third Party Assessment and Oversight – The Company maintains a third-party risk management program designed to identify and 22manage cybersecurity risks from third-party service providers, including initial due diligence and assessment of the service 23provider’s control environment as well as periodic re-assessments.24• Security Training and Awareness – The Company provides ongoing education and training to employees regarding information 25security threats, and their role and responsibility in detecting and responding to such threats. 26In addition to the above, where appropriate, AIG employs third-party experts to evaluate our cybersecurity risk management program.  27The Company conducts annual external penetration tests to simulate real-world attacks against the Company’s networks and 28applications which supplement our continuous internal application security assessments. These independent evaluations help 29uncover potential security vulnerabilities for remediation by our cybersecurity team. We also operate a bug bounty program through a 30crowdsourced security platform to incentivize responsible disclosure of software defects by global security researchers.31The Program is evaluated on an ongoing basis both internally and through the use of third-party audit firms to address and protect 32against the evolving cyber threat landscape and seeks to align to industry standards such as the National Institute of Standards and 33Technology Cybersecurity Framework, as well as applicable legal and regulatory guidance and mandates related to all AIG 34stakeholders, including investors, customers, and employees. Control adequacy and design are reviewed at least annually, and 35independent audits and penetration tests assist in identifying areas for continued focus, improvement and/or inclusion, and are 36designed to provide assurance that controls are appropriately designed and operating effectively. Additionally, the Company's Internal 37Audit group performs independent testing of the Company’s control environment, including key components of the Program.38Board Oversight and Governance39AIG's Board of Directors (the Board) oversees the Program and management of risks from cybersecurity threats and reviews and 40monitors AIG's business and technology strategy, including the policies, processes and practices that the Company’s management 41implements to address risks from cybersecurity threats. The Board believes that all directors are responsible for oversight of these 42matters given the increasing importance of cybersecurity to AIG’s risk profile, as well as the significant role the Company’s technology 43strategy plays in its strategic priorities. The Chief Information Officer (CIO), CISO and Chief Risk Officer provide updates to the Board 44as appropriate.45Global Committees46Group Risk Committee (GRC): The GRC is a committee comprised of senior management and is responsible for assessing 47significant risk issues on a global basis to protect AIG’s financial strength, optimize AIG’s intrinsic value, and protect AIG’s reputation. 48The risks considered by the GRC include those relating to cybersecurity.49ITEM 1C | Cybersecurity5038 AIG | 2023 Form 10-K