XML 51 R31.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] We seek to identify, assess, and manage these risks, with the aim of safeguarding our critical systems and information, and employ a documented process to respond in the event of a cybersecurity incident. This approach includes regular evaluations of our information systems and infrastructure to identify vulnerabilities and potential weaknesses through the use of system monitoring tools, as well as monitoring industry trends, threat intelligence, and emerging risks to anticipate and proactively assess potential threats. We engage third-party cybersecurity experts to conduct penetration testing, vulnerability scans, and risk assessments, informed by the NIST (National Institute of Standards and Technology) Cybersecurity Framework guidelines or ISO (International Organization for Standardization) 27001 standard, to increase the likelihood that system risks are identified.
To identify potential risks, Ambac or a third party vendor engaged by the Company also assesses the security measures of vendors and third-party service providers that have access to the Company’s information systems and sensitive data. Each review involves an initial risk assessment of the provider, and initial and periodic reviews of the provider's cybersecurity program to evaluate security standards, access controls and security measures. The Company generally requires vendors and third party service providers to report to the Company any cybersecurity incidents involving the providers’ systems that could affect the Company, or to have cybersecurity incident notice requirements in their cybersecurity programs.
Our approach to managing cybersecurity risks includes implementing cybersecurity measures such as selective use of encryption, firewalls, data loss prevention, security monitoring, endpoint detection and response, anti-spam and anti-phishing email security, and intrusion detection systems to fortify our defenses. We conduct mandatory annual employee cybersecurity training programs and frequent simulated phishing campaigns to enhance cybersecurity knowledge and practices across the organization. Ambac maintains an incident response plan that is updated regularly to respond to changes in the organization, risks and laws. Ambac also conducts an annual test to restore business critical systems and data from back-ups. We have established reporting processes and escalation pathways for our business units and functions to identify, assess and manage potential cybersecurity incidents in a timely manner. Once an incident is identified, the Chief Information Security Officer (“CISO”) (with the assistance of the IT team) will begin the investigation to determine the level of risk of the event and the appropriate response.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Cybersecurity risk is also included in the Company’s Enterprise Risk Management (“ERM”) process that involves senior management and other personnel in the identification, assessment and management of a broad range of risks (including cybersecurity risks) that could affect the Company’s ability to execute on its corporate strategy and fulfill its business objectives.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Board of Directors of the Company oversees the management of risks from cybersecurity threats through its review of quarterly reports from the CISO on the status of the Company’s cybersecurity preparedness; updates on information systems; and any cybersecurity threats of which management has become aware. In addition the Board receives periodic cybersecurity awareness training.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Enterprise Risk Committee produces the relevant risk management information for executive and senior management and the Board of Directors, which receives ERM updates on a quarterly basis.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Company’s Chief Operating Officer and Chief Information Officer provide input and updates to the Enterprise Risk Committee (comprised of members of management) on cybersecurity preparedness and emerging risks.
Cybersecurity Risk Role of Management [Text Block] The Company’s technology staff and CISO conduct weekly meetings to review: (i) implementation of new security measures, (ii) results of existing technical system monitoring tools to identify any potential risk and propose remediation, as necessary; (iii) newly disclosed software patch updates to assess risks and set patch implementation priorities; and (iv) threat intelligence from various organizations, such as the Cybersecurity and Infrastructure Security Agency, to assess risks and suggest security measures, as necessary.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
The Company’s Chief Information Officer and CISO bring over 35 years of combined experience in the technology and cybersecurity space. The Chief Information Officer has served as a chief information officer and chief technology officer of both private and public institutions for the past 10 years and was responsible for the IT operations and cybersecurity practices of those institutions. The CISO is a certified cybersecurity professional and technologist. He holds an active ISO/ANSI-accredited cybersecurity certification and has experience managing security programs across multiple industries, including financial services and insurance. Other credentials among Ambac’s IT staff include a Certified Information Systems Security Professional certification and a Masters Degree in cybersecurity risk and management.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Chief Operating Officer and Chief Information Officer are also members of the Company's Disclosure Committee and provide updates on cybersecurity threats and emerging risks to the Disclosure Committee prior to the filing of each quarterly report on Form 10-Q and annual report on Form 10-K.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true