Verisk Analytics Inc

We remain steadfast in our commitment to safeguarding the confidentiality, integrity, availability, and responsible use of data. Our rigorous approach to cybersecurity is a comprehensive framework comprising cyber risk governance, risk identification and management, risk prevention and protection, monitoring and detection, and response and recovery planning, which is an integral part of our overall enterprise risk management ("Framework").

Cyber risk governance is founded on direction and priorities established by our leadership, supported and overseen by the Board of Directors ("Board"), and deployed through our Framework. The Framework leverages proven standards such as those embedded in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), which are generally accepted by cybersecurity leaders across industries.

The Board oversees our management of cybersecurity, including oversight of appropriate risk mitigation strategies. The Board receives regular reports from executives about our cybersecurity risks, management review processes, overall health and readiness to respond to an incident. The Risk Committee of the Board was established in February 2024 to oversee risk assessment and risk management of the Company in coordination with other relevant Board Committees as appropriate, including but not limited to the policies, procedures and strategic approach to cyber, technology and information security risks. The Risk Committee of the Board also reports material cybersecurity risks to our full Board.

The Executive Risk Management Committee ("ERMC"), which includes the top corporate executives, is responsible for providing guidance and enforcing our Framework, including the strategies, policies, procedures, processes, and systems, established by management to identify, assess, measure, monitor, and manage risks. The ERMC also reinforces the corporate risk appetite, determines whether residual risk is acceptable, and confirms materiality of security incidents.

The Enterprise Risk Management ("ERM") division of the Company oversees and advises on implementation of the Framework throughout our business units. In doing so, the ERM division aggregates and assesses risk across the enterprise. Within the ERM division is the Chief Information Security Officer ("CISO"), who leads our Cybersecurity and Information Risk Management functions. The CISO’s functions partner with the business units to help ensure that cybersecurity risk management strategies are implemented and dedicated liaisons from the business units report to the CISO with meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the CISO’s reporting framework. The ERM division hosts training and awareness sessions, sponsors working groups across the enterprise on critical security topics and provides centralized cybersecurity incident response. Also within the ERM division is ourthird-party risk program, which implements processes to identify cybersecurity risk associated with ourthird-party providers. Management, including the CISO and our cybersecurity team, regularly update the Risk committee on our cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics,third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.

Our business units have dedicated liaisons for risk management activities, who participate in a global security council designed to facilitate implementation of the Framework and associated policies. As custodians and/or processors of our stakeholders’ data, our business units also accept certain compliance responsibilities, including butnot limited to, aspects of the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act (CCPA), the Gramm-Leach Bliley Act ("GLBA"), the Health Insurance Portability and Accountability Act ("HIPAA"), the Fair Credit Reporting Act ("FCRA"), and the Payment Card Industry ("PCI") standard, all to the extent applicable. For each of its business units, we seek to actively confirm that its risk management practices fulfill applicable compliance requirements.

We have adopted a defense-in-depth strategy with a wide range of measures to secure our technology infrastructure and data as per our Framework. Security measures cover the following key areas as aligned with NIST CSF: risk identification and management, risk prevention and protection, monitoring and detection, and response and recovery planning. Key control functions that comprise the security measures include but arenot limited to: risk assessment, asset management, supply chain risk management, identity and access management, customer credentialing, physical security, application and infrastructure security, perimeter and network security, secure development and change management, configuration management, endpoint security, security audit logging and monitoring, security operations center, incident response, business continuity and disaster recovery.

Our cybersecurity strategy includes the engagement of strategic providers, consultants and independent assessors to inform us of cyber threats and assess the effectiveness of control design and implementation. Strategic providers include, but arenot limited to, a Managed Security Service Provider for our security operations center, as well as service providers that supplement incident response processes related to threat intelligence and dark web monitoring. Independent assessors include, but arenot limited to, our Internal Audit Department which provides reports to the Audit Committee, as well as assessors that are engaged directly to perform external audits and penetration tests. Through independent assessors, our commitment to security has earned ISO27001:2013 Certification for our core ERM centrally provided cybersecurity services, which is an international standard for best practices associated with our Information Security Management System.

As discussed more fully under “Item1A – Risk Factors,” although our processes are designed to help identify, protect, detect, respond to and mitigate potential cybersecurity incidents, cybersecurity threats are rapidly evolving and we* may**not* be able to anticipate, prevent or detect all such attacks and there isno guarantee that a future cybersecurity incident wouldnot materially affect our business strategy, results of operations, or financial condition.

24