American National Group Inc.

Risk Management and Strategy; Governance

The Company maintains a documented Information Security Risk Management Program (“Program”) that includes risk assessments regularly conducted by the Company andthird-party experts, assessors and auditors to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. The Program is integrated into the Company’s overall risk management program. The Program is informed by industry standards, regulatory requirements, and frameworks and is evaluated on an ongoing basis to address the evolving cyber threat landscape and seek alignment with industry standards such as applicable legal and regulatory guidance and mandates. In addition, the Company regularly self-assesses the Program against its internal policies.

As part of the Program, the Company deploys technical and organizational safeguards designed to protect the Company’s networks, systems, and data from cybersecurity threats; maintains a threat management program that continuously monitors evolving cybersecurity risks; has established and maintains incident response plans that address the Company’s response to a cybersecurity incident; maintains a third-party risk management program that includes a due diligence and ongoing assessment process for service providers based on the risk they present and the adequacy of their safeguards; and provides ongoing education and training to employees regarding information security threats. The Company also conducts periodic penetration testing and tabletop exercises.

The Company’s Chief Information Security Officers, experienced information systems security professionals with many years of experience across a variety of technology sub-specialties, provide oversight and direction for the Program and regularly communicate the information security risk posture and the prevention, detection, mitigation, and remediation of cybersecurity incidents to the Company’sexecutive team and the Company’s Audit and Risk Management Committee. Our Chief Information Security Officers and the Audit and Risk Management Committee oversee the Program and management of risks from cybersecurity threats and review and monitor the Company’s business and technology strategy.

As of the reporting date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See also Item 1A ''Risk Factors - Risks Relating to Our Business and Industry - Failure to maintain the security of our information and technology systems could have an adverse effect on our business.''