OLD REPUBLIC INTERNATIONAL CORP

Old Republic depends upon technology-based information systems to conduct business. The Company uses computer systems and other electronic information resources, including both proprietary and third-party technology systems and tools, to process, transmit, receive, and store certain personal, confidential, and proprietary information; to communicate with customers, service providers, and other third parties by email and other electronic means; and perform various business operations, including transferring significant amounts of funds.

The Company’s systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include ransom attacks, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company’s information systems or the information systems of a third-party vendor or services provider could adversely affect the Company’s business strategy, results of operations, or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues, and reputational damage.

Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure, and procedures in an effort to prevent, detect, address, and mitigate these risks. The Company’s Chief Information Security Officer (CISO) oversees the Company’s enterprise cybersecurity strategy while the Company’s Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company’s Board of Directors’ oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure, as well as the Company's practices and protocols for the use of AI. The Company’s CISO and Deputy CISO both have extensive experience leading large and complex cybersecurity programs. The CISO formerly served as the cybersecurity leader for Old Republic National Title Insurance Group, and designed and assisted in the implementation of the enterprise security program for a state government. The Deputy CISO formerly served as the cybersecurity leader of a publicly traded retail company and has extensive experience in various industries, including financial services.

The Company maintains a cybersecurity program, which is supplemented by the security program of each Old Republic operating company based on its particular risk, applicable insurance industry requirements, and mandates and guidance from the CISO and enterprise-wide security advisory team. These programs encompass asset protection, threat identification, monitoring, timely response procedures, containment and recovery measures, and internal escalation procedures. An enterprise-wide information technology team consisting of a working group of information technology leaders representing all operating companies meets regularly for the review and monitoring of and updates to information security business processes due to significant changes in operating environments, statutory or regulatory changes, or changing or emerging threats. Operating companies are required to report certain cyber incidents based on documented severity classification to the enterprise-wide information technology team. This team consists of key information technology personnel, including the CISO and the Chief Information Officer (CIO). They are responsible for overseeing incident response and escalation to the Company’s General Counsel and Chief Financial Officer (CFO) when necessary. As part of the Company’s overall risk management strategy, the General Counsel, CFO, and CIO, in consultation with the CEO, navigate escalated incidents for law enforcement and other external engagements, and assess the impact and materiality of such incidents on the Company’s enterprise-wide business.

While exact practices vary depending on each operating company's particular business and risk, risk assessments performed at the enterprise and subsidiary levels generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These assessments are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of the Company's information systems and nonpublic information processed on the Company’s information systems. Administrative, technical, and physical safeguards are implemented to protect the Company’s information systems from unauthorized access, use, or disruption.

When engaging third-party service providers (or vendors), operating companies are directed to use cybersecurity screening and risk assessment measures and to include appropriate data and system security, data privacy, and use of AI terms and conditions in vendor agreements, including, as necessary for certain vendors, a duty to report certain security incidents to the Company’s information technology team. Third-party engagement procedures generally include (1) the identification and risk assessment of third-party service providers; (2) minimum cybersecurity practices required to be met by such third-party service providers in order for them to do business with the Company; (3) due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-party service providers; and (4) periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices.

Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company’s security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages third-party assessors, consultants, and auditors to provide advisory services related to security technologies and practices.

Old Republic offers and requires security awareness and training initiatives for the holding company and each operating company to inform associates about the current cybersecurity threat environment, applicable cybersecurity requirements, and the role of each associate in cybersecurity risk mitigation.

The Audit Committee of the Company’s Board of Directors has oversight authority to review the Company’s data protection and cybersecurity risk exposure and the steps management has taken to assess and respond to the overall threat landscape, including management's strategy to mitigate the Company’s cyber risk exposure. The CISO and CIO report to the Audit Committee on current data protection and cybersecurity matters quarterly, and as may otherwise be needed. The CISO is authorized to report directly to the Audit Committee on the Company’s security program and status of cybersecurity risk management efforts. The Chair of the Audit Committee reports these matters, as appropriate, to the Board of Directors.