American National Group Inc. 10-K Cybersecurity GRC - 2025-03-31

Page last updated on March 31, 2025

American National Group Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2025-03-31 13:48:54 EDT.

Filings

10-K filed on 2025-03-31

American National Group Inc. filed a 10-K at 2025-03-31 13:48:54 EDT
Accession Number: 0001039828-25-000010

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Risk Management and Strategy; Governance The Company maintains a documented Information Security Risk Management Program (“Program”) that includes risk assessments regularly conducted by the Company and third-party experts , assessors and auditors to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. The Program is integrated into the Company’s overall risk management system. The Program is informed by industry standards and frameworks and is evaluated on an ongoing basis to address the evolving cyber threat landscape and seek alignment with industry standards such as applicable legal and regulatory guidance and mandates. In addition, the Company regularly self-assesses the Program against its internal policies. As part of the Program, the Company deploys technical and organizational safeguards designed to protect the Company’s networks, systems, and data from cybersecurity threats; maintains a threat management program that continuously monitors evolving cybersecurity risks; has established and maintains incident response plans that address the Company’s response to a cybersecurity incident; maintains a third-party risk management program that includes a due diligence and ongoing assessment process for service providers based on the risk they present and the adequacy of their safeguards; and provides ongoing education and training to employees regarding information security threats. The Company also conducts periodic penetration testing and tabletop exercises. The Company’s Chief Information Security Officers , experienced information systems security professionals with many years of experience across a variety of technology sub-specialties, provide oversight and direction for the Program and regularly communicates the information security risk posture and the prevention, detection, mitigation, and remediation of cybersecurity incidents to the Company’s executive team and the Company’s Audit and Risk Management Committee . Our Chief Information Security Officers and The Audit and Risk Management Committee oversees the Program and management of risks from cybersecurity threats and reviews and monitors the Company’s business and technology strategy. As of the reporting date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See also Item 1A “Risk Factors - Risks Relating to Our Business and Industry - We rely on the use of technology, and as a result, we are exposed to the risks of cybersecurity attacks and other systems disruptions.”

Company Information