Search every filing
2,476,630 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
Cybersecurity and Privacy. The SEC maintains cybersecurity disclosure rules (“SEC Cybersecurity Rules”) mandating cybersecurity incident and risk management disclosure for public companies such as Arch. The SEC Cybersecurity Rules became effective in 2023 and mandate that public companies report a cybersecurity incident on a Form 8-K within four days after they determine that the incident is material. Additional disclosure by registrants in the Form 10-K annual report should describe their processes for assessing, identifying and managing material risks from cybersecurity threats, the material impacts of cybersecurity threats and previous cybersecurity incidents. See Item 1C, “Cybersecurity” for further information about our disclosures.
Read in the filing ↗ Also in 10-K of Feb 27, 2025
Based on our investigations and incident management, the Company does not believe these and other cybersecurity incidents we have experienced to date have materially affected the Company’s business operations, but we cannot provide assurances that our controls will defend against all cyber attacks. See Item 1C, “Cybersecurity” for additional information.
Read in the filing ↗ Also in 10-K of Feb 27, 2025
Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. We annually undergo an external penetration testing by a third party cybersecurity firm. These tests and our tabletop exercises enable us to incorporate recommendations and learnings in our program. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.
Read in the filing ↗ Also in 10-K of Feb 27, 2025
As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks and incidents. Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology (“IT”) processes encompassing incident response, access control, disaster recovery and testing, among other areas.
Read in the filing ↗ Also in 10-K of Feb 26, 2026
The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions that we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as AI may further expose our information systems to the risk of cybersecurity incidents. See Item 1A, “Risk Factors - Risk Relating to Our Industry, Business & Operations - Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation.”
Read in the filing ↗ Also in 10-K of Feb 27, 2025
In 2022, the U.S. government passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which will require companies deemed to be part of U.S. critical infrastructure to report any substantial cybersecurity incidents or ransom payments to the federal government within 72 and 24 hours, respectively. The Cybersecurity & Infrastructure Security Agency (“CISA”) considers financial services, which includes insurance companies, as a critical infrastructure sector. CISA is expected to publish final implementing regulations in May 2026.
Read in the filing ↗
In March 2022, the U.S. government passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which will require companies deemed to be part of U.S. critical infrastructure to report any substantial cybersecurity incidents or ransom payments to the federal government within 72 and 24 hours, respectively. The Cybersecurity & Infrastructure Security Agency considers financial services, which includes insurance companies, as a critical infrastructure sector. The implementing regulations are not expected on or before October 4, 2025.
Read in the filing ↗
• The Crisis Incident Management Team (“CIMT”), which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Each quarter, the CIMT exercises its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options.
Read in the filing ↗ Also in 10-K of Feb 27, 2025
We are subject to many laws and regulations relating to the adequacy of cybersecurity programs and business resiliency, including the SEC Cybersecurity Rules, and comprehensive privacy, security and business resiliency laws in the EU such as GDPR and DORA. Some U.S. industry regulators like the NYDFS in New York also impose comprehensive cybersecurity requirements on our U.S. operations. A cybersecurity incident could result in a violation of these and other applicable laws, resulting in damage to our reputation, loss of customers, decline in our stock price, litigation,
Read in the filing ↗ Also in 10-K of Feb 27, 2025
Cybersecurity incidents and attacks resulting in unauthorized access to our systems and those of third parties we use in our business could have a material impact on our business operations as a result of loss or misuse of our information, including personal data and sensitive data, and disruption to normal business operations. Specifically, these incidents, and the disruptions resulting therefrom, may impact the availability, reliability, speed, accuracy or other proper functioning of these systems.
Read in the filing ↗ Also in 10-K of Feb 27, 2025
• We could be materially impacted by a cyber attack, data breach, ransomware, phishing, social engineering or other cybersecurity incident resulting in loss of business data, personal data and other confidential or secret information, a disruption in our business operations, regulatory or other legal action, and fines.
Read in the filing ↗ Also in 10-K of Feb 26, 2026, 10-K of Feb 27, 2025, 10-K of Feb 27, 2025
While we believe we have effective technical and organizational measures in place to prevent, detect, manage and mitigate the impact of data breaches and cybersecurity incidents caused by malicious actors, systemic failures or human error, we cannot offer complete assurances that significant data breaches on our systems and those of third parties we use will not occur.
Read in the filing ↗ Also in 10-K of Feb 27, 2025
across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, the ORC reviews the Company’s programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO’s quarterly report to the Audit Committee.
Read in the filing ↗
• The Operational Risk Committee (“ORC”), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, the ORC reviews the Company’s programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO’s quarterly report to the Audit Committee.
Read in the filing ↗
We rely on certain third-party technology service providers and other service providers, notably major cloud providers, Software-as-a-Service (or “SaaS”) solutions, and on-premise software, including proprietary and open source solutions. We also outsource certain business processes to third parties and may continue do so in the future. This practice exposes us to increased risks if those third-party systems are not maintained and monitored in accordance with contractual terms or due to human error. There is no assurance that we will not be materially adversely affected by such incidents impacting our critical and important functions. See Item 1C, “Cybersecurity” for additional information.
Read in the filing ↗ Also in 10-K of Feb 26, 2026