XML 78 R50.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
The Company has developed an information security program to assess, identify, and monitor cybersecurity risks. Each year, the Company assesses cybersecurity risks arising from the operating environment. In developing the assessment process, the Company reviews guidance from national standards organizations such as the NIST and the Center for Internet Security. In evaluating the risks identified as a part of this assessment, the Company’s information security team considers the likelihood and severity of the risk and the possible impact of the risk on the Company, its customers, and its employees. These risks are then monitored by the Company’s information security team.
The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems. Tests are conducted by both internal security teams and third-party consultants. In developing the testing procedures, the Company considers its individual risks and industry standards. Testing procedures are supplemented by executive cyber threat exercises and employee training. Executive exercises such as “tabletops” are used to develop and refine the Company’s incident response plans. Employees undergo security awareness training annually and upon hire.
As a part of its information security program, the Company addresses cyber risks posed by its relationships with third-party service and application providers. The Company assesses third parties as a part of the procurement process, including through pre-acquisition diligence. Contractual provisions based on regulatory requirements and industry standards are used in the contracting process, and the Company conducts on-going performance monitoring of key vendors. Security audits are also performed on certain vendors to review compliance with contractual requirements and industry standards.
The Company maintains an incident response plan that includes procedures for evaluating and addressing a cybersecurity event. The initial impact of each cybersecurity event is evaluated by a designated team using pre-established risk criteria. If an event meets certain parameters, it is escalated to a cross-functional core team of executives, including the Company’s Chief Information Security Officer (“CISO”) and designated internal legal counsel. The Company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The incident response plan identifies certain third-party advisors, consultants and legal counsel who have been designated to assist if necessary. The plan contains procedures for escalating cybersecurity incidents to the Board of Directors.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Kemper’s information security program is an element of the Company’s broader Enterprise Risk Management (ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company’s Enterprise Risk Committee (“ERC”), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company’s ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Company’s CISO is primarily responsible for management of the Company’s information security program. The Company’s current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence, risk sharing organizations and law enforcement organizations.
Kemper’s information security program is an element of the Company’s broader Enterprise Risk Management (ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company’s Enterprise Risk Committee (“ERC”), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company’s ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.
Through its role in providing oversight for the Company’s ERM framework, the Risk Committee of the Kemper Board of Directors (the “Risk Committee”) provides oversight of the Company’s information security program. On a quarterly basis, management discusses Kemper’s information security program, cybersecurity risks, and related developments with the Risk
Committee. The Risk Committee periodically reviews and evaluates information security and cybersecurity risks and provides oversight of events that have been escalated as a part of the incident response plan.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Company’s CISO is primarily responsible for management of the Company’s information security program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Company’s Enterprise Risk Committee (“ERC”), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company’s ERM framework.
Cybersecurity Risk Role of Management [Text Block] Through its role in providing oversight for the Company’s ERM framework, the Risk Committee of the Kemper Board of Directors (the “Risk Committee”) provides oversight of the Company’s information security program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Company’s CISO is primarily responsible for management of the Company’s information security program.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Company’s current CISO has significant experience in information security, as do members of the information security team.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] On a quarterly basis, management discusses Kemper’s information security program, cybersecurity risks, and related developments with the Risk
Committee. The Risk Committee periodically reviews and evaluates information security and cybersecurity risks and provides oversight of events that have been escalated as a part of the incident response plan.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true