Global Indemnity Group, LLC

Risk Management and Strategy

The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program designed to assess, identify, and manage risks from cybersecurity threats. The Company uses information from multiple sources, including internal incident history, industry publications, government and industry information sharing organizations, and recognized information security frameworks, to inform its risk management program. The Company employs a combination of preventative and detective cybersecurity measures, including various security tools and qualified personnel, to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

Managing Material Risks & Integrated Overall Risk Management

The Company hasintegrated cybersecurity risk management within its broader Enterprise Risk Management ("ERM") framework. Led by the President of Belmont Holdings GX, Inc., the Company’s risk management team, comprised of senior management team members, evaluates cybersecurity risks in accordance with its business objectives, operational needs, and regulatory requirements. This integration ensures that cybersecurity considerations are embedded within the Company’s overall risk assessment processes and strategic decision-making.

Acknowledging the complex and evolving landscape of cybersecurity threats, the Company collaborates with external experts, including cybersecurity assessors, consultants, and auditors, to evaluate and test its risk mitigation tools. The Company’sengagement with these external entities encompasses routine reviews, threat assessments, and ongoing consultations designed to strengthen the Company’s security measures and ensure alignment with industry best practices.

Prior to engagement, the Company undertakes security assessments of third-party service providers that process or store confidential Company information. The Company monitors the cybersecurity practices of these third-party providers for alignment with the Company’s cybersecurity standards. This ongoing monitoring involves evaluations performed by the Company’s team of security analysts, as well as annual review by the Company’s Chief Information Security Officer (“CISO”).

Risks from Cybersecurity Threats

As of the date of this report, the Company believes that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, havenot materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Refer to the risk factor captioned “A failure in the Company’s operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company’s business, its reputation, and/or cause losses which could have an adverse effect on the Company’s business operations and financial results” in Part I, Item 1A. “Risk Factors” for additional information on cybersecurity risks that could adversely impact the Company’s business, results of operations, or financial condition.

Governance

Board of Directors Oversight

The Enterprise Risk Management Committee (the “ERM Committee”) of the Board of Directors is central to the Board’s oversight of cybersecurity risks. The Board has established these oversight mechanisms because it recognizes the significance of cybersecurity threats to the Company’s operational integrity and stakeholder confidence.

The CISO provides the ERM Committee with quarterly reports addressing the following topics:

•

the Company’s threat profile and emerging threats;

•

the status of cybersecurity initiatives and strategies;

•

incident reports and learnings from any cybersecurity events; and

•

compliance with regulatory requirements and industry standards.

The Company conducts an annual review of its cybersecurity posture and the effectiveness of its risk mitigation strategies. This review assists in identifying areas for improvement and aligning the Company’s cybersecurity efforts with the overall risk management framework.

Management’s Role in Managing Risk

Primary responsibility for assessing, monitoring, and managing the Company’s cybersecurity risks rests with the CISO, who has obtained relevant cybersecurity credentials and possesses expertise in the technical domain. The CISO receives assistance from industry experts in decision-making and oversees the Company’s information security policies and data protection programs, the implementation of protective and detective tools, compliance testing against applicable standards, and remediation of known risks. These initiatives include phishing simulations, semi-annual cybersecurity education for employees, and competency assessments. Additionally, the Company conducts tabletop incident response exercises and other measures to enhance overall cybersecurity preparedness.

The CISO remains informed about developments in cybersecurity, including emerging threats and evolving risk management techniques. This ongoing knowledge acquisition is essential for the prevention, detection, mitigation, and remediation of cybersecurity incidents.

Monitoring Cybersecurity Incidents

In the event of a cybersecurity incident, the CISO is equipped with a Cyber Incident Response Plan (“CIRP”), supported by a cross-functional Cyber Incident Response Team (“CIRT”). The CIRT oversees and responds to cybersecurity incidents, with core objectives encompassing detection and response, incident analysis and investigation, containment and eradication measures, and recovery processes. The CIRT also coordinates communication with the Company’s management, regulators, affected parties, and external security experts. The CIRT is responsible for determining the materiality of incidents, maintaining documentation and reporting practices, and fostering a culture of continuous improvement.

Reporting to the Board of Directors

The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of matters related to cybersecurity risks and incidents. The CISO escalates significant cybersecurity matters to the ERM Committee, ensuring the Board maintains appropriate visibility into the Company’s cybersecurity risk profile and the effectiveness of its security posture.