XML 109 R36.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. This includes scanning our internal network and infrastructure at least monthly to enhance security measures and conducting third-party vulnerability testing at minimum on an annual basis to better protect against external attacks. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

In particular, our information security program and approach are based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST Framework”). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties. This program includes categorizing vendor risk based upon the types of service being provided and types of data handled, performing risk assessments using proforma questionnaires, and undertaking reviews of Systems and Organization Controls (SOC) reports for critical vendor relationships.

In accordance with these policies, we share personal information with affiliates, business partners, third-party service providers, or vendors only when we have a legitimate business purpose for doing so and it is permissible by law. We require third parties to maintain similar standards to ours to protect personal information. We have implemented a risk mitigation process to identify and assess the cyber posture of third parties providing commodities or services to our legal entities. We also have implemented multiple layers of data protection measures.

We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. As part of continuous improvement initiative, we strive to mature and build a robust and resilient environment to protect and defend against bad actors. We engage third parties to perform internal and external testing to improve security operations, disaster recovery, and incident response programs.
As we have noted, increased adoption of AI technologies, especially Generative AI, may increase cybersecurity risks, so Argo Group has instituted an AI Policy specifically addressing such risks. Additionally, we have implemented additional technical controls to help safeguard against data loss to generative AI and have established a cross-functional AI Working Group, which meets on a periodic basis to ensure that the company remains abreast of any AI developments that may require changes to our security posture.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. This includes scanning our internal network and infrastructure at least monthly to enhance security measures and conducting third-party vulnerability testing at minimum on an annual basis to better protect against external attacks. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.
In particular, our information security program and approach are based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST Framework”). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our Board oversees the Company’s risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Company’s Audit & Risk Management Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Meetings of the Audit & Risk Management Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Audit & Risk Management Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Information Officer and Chief Information Security Officer regularly reports on data protection and information technology security matters to the Audit & Risk Management Committee and to Argo senior management via Security Governance Council meetings.
Cybersecurity Risk Role of Management [Text Block]
As discussed above, our information security program and approach are based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Information Security Officer, under the guidance of the Chief Information Officer and in coordination with the Head of Risk, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Information Security Officer holds the Certified Information Systems Security Professional (CISSP) designation, has over 20 years of experience working in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.
In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo’s material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions at least annually to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Chief Information Officer and Chief Information Security Officer regularly reports on data protection and information technology security matters to the Audit & Risk Management Committee and to Argo senior management via Security Governance Council meetings.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Chief Information Security Officer holds the Certified Information Systems Security Professional (CISSP) designation, has over 20 years of experience working in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our Chief Information Officer and Chief Information Security Officer regularly reports on data protection and information technology security matters to the Audit & Risk Management Committee and to Argo senior management via Security Governance Council meetings.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true