The impacts of climate change, and legal or regulatory measures to address climate change, may adversely affect our results of operations or financial condition. Our businesses, results of operations, and financial condition could be impacted by risks associated with climate change, including:
- changes from legislation, regulation and court decisions that:
◦create economic and regulatory uncertainty,
◦increase our compliance costs,
◦impose liability on or increase exposure for our policyholders not contemplated during our underwriting,
◦change our ability to provide insurance coverage to certain policyholders, or
◦impose new or additional requirements that increase the costs associated with, or disrupt, sourcing, manufacturing, and distribution of, our products and services,
- changes in the frequency, severity, and location of weather-related catastrophes, such as hurricanes, tornados, windstorms, floods, wildfires, and other extreme weather events, which may:
◦result in insured losses that exceed our expectations or make it more difficult for us to predict and model catastrophic events, reducing our ability to accurately price our exposure to such events and mitigate our risks,
◦make it more difficult or expensive for us to obtain reinsurance at desired levels, or
◦increase physical risks to and impacts on our operations,
- changing demand for insurance coverage we provide, such as demand from industries that produce or use carbon-based energy including those transitioning from those energy sources, decreased availability of reinsurance available for coverages we provide for carbon intensive industries, or increased claims and losses related to those industries, and
- losses on our invested assets, including from:
◦changes in supply and demand,
◦advances in low-carbon technology and renewable energy development,
◦effects of extreme weather events on the physical and operational exposure of industries and issuers, and
◦the transition that companies make towards addressing climate risk in their own businesses.
Item 1C. CYBERSECURITY
Markel Group is a holding company comprised of a diverse group of companies and investments. Our specialty insurance business, Markel, sits at the core of our company. Markel Group utilizes information technology systems and services, including cybersecurity, provided and/or administered by Markel. Through Markel Group's wholly owned subsidiary, Markel Ventures, Inc. (Markel Ventures), Markel Group owns controlling interests in businesses that operate in a variety of industries. The Markel Ventures businesses are independently managed with respect to their information security and data protection programs.
Insurance
In order to maintain a strong cybersecurity program, Markel uses a variety of controls and technology tools designed to identify, detect, prevent, respond to, and recover from security threats. Markel undergoes regular security audits including a System and Organization Controls (SOC) audit for Cybersecurity conducted annually by independent auditors in which cybersecurity threats are identified and assessed. Markel regularly tests aspects of its internal security and conducts security risk interviews and assessments on third parties with whom it does business, depending on the nature of the relationship. Markel has invested in technology that assists its risk management teams in measuring and addressing weaknesses in its third-party and supply chain community. Markel performs continuous monitoring of all its third parties to ensure they are maintaining acceptable levels of security controls and remediating any known weaknesses.
Markel participates in the Financial Services Information Sharing and Analysis Center to share information about the latest cyber threats and preparedness measures. Markel also shares threat intelligence information with other partners. Markel has a cybersecurity incident response plan, as well as a crisis management plan, that cover cyber events, including a process for determining the materiality of cyber events that includes evaluation by a cross functional crisis management group including security, information technology, finance, legal and business and escalation to Markel Group senior management as warranted by the severity of the situation. An internal team engages in tabletop exercises several times each year to enhance preparedness for such situations.
Information security and data protection risks are the responsibility of all employees. Markel has a mandatory training program covering a variety of security and data protection disciplines. In addition, all Markel employees are required to acknowledge annually policies on acceptable use of Markel's technology resources and enterprise information security. Contractors are required to provide certain representations and certifications relating to information security.
The Markel information security and data protection program is led by a Chief Information Security Officer (CISO) who supervises a team of security and data protection professionals across the globe. Markel's global information security and data protection program leverages the Cybersecurity Framework from the National Institutes of Standards and Technology as well as industry best practices. Markel also is able to map to both ISO (International Organization for Standardization) and BSI (British Standards Institution) among other cybersecurity standards. Markel's CISO has been with Markel 13 years and has 22 years' experience in information technology, with 17 years in information technology security, and is a certified Information Systems Security Professional (CISSP).