SiriusPoint Ltd

The Company is subject to several cybersecurity and data privacy laws and regulations promulgated by the BMA, NYDFS, FCA, PRA, and SFSA. The Company’s risk management program is designed to support compliance with these laws and regulations.

The Board is responsible for overseeing the Company’s risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company’s risk management program and its cybersecurity policies, processes, and practices. The Company’s cybersecurity policies, standards, processes, and practices are based on the framework established by the National Institute of Standards and Technology Cybersecurity Framework (CSF) and are integrated into the Company’s overall risk management system and processes.

In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company’s information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur. Given the increasing sophistication of cybersecurity threats, including those leveraging artificial intelligence, the Company regularly reviews and updates its strategies and technologies to ensure they remain effective in the face of emerging threats.

Cybersecurity Risk Management and Strategy

The Company’s cybersecurity risk management strategy focuses on several areas:

•Identification, Mitigation and Monitoring: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and applies a security-first mindset to our practices across the Company. The Company’s program is comprised of internal resources and external security consultants to provide guidance, oversight and support.

•Technical Safeguards: The Company implements technical safeguards through a layered security approach and third-party platforms that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, data loss prevention and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications.

•Incident Response and Recovery Planning: The Company’s program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility, as well as to assess the requirement to disclose and report material incidents in a timely manner. The Company has established and maintains comprehensive incident response and disaster recovery plans designed to address the Company’s response to a cybersecurity incident. The Company conducts periodic tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

•Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems.

•Education and Awareness: The Company conducts regular, mandatory training and simulated phishing campaigns for all levels of employees regarding cybersecurity threats as a means to equip the Company’s employees with effective tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes, and practices.

The Company conducts periodic assessment and testing of the Company’s policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. For example, the Company performs internal and external penetration tests and cyber red team and tabletop exercises. The results of such assessments, audits, and reviews are evaluated by management and reported to the Risk Capital Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

Governance

The Board, in coordination with the Risk Capital Management Committee, oversees the Company’s risk management program, including the management of cybersecurity threats. The Board and the Risk Capital Management Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company’s peers and third parties. The Board and the Risk Capital Management Committee also receive prompt and timely information regarding any cybersecurity risk, as well as ongoing updates regarding any such risk. On a quarterly basis, the Board and the Risk Capital Management Committee discuss the Company’s approach to overseeing cybersecurity threats with the Company’s Chief Information Security Officer (“CISO”) and other members of senior management.

The CISO, in coordination with senior management including the Chief Executive Officer, Chief Financial Officer, Chief Information and Technology Officer (“CITO”) and Chief Legal Officer, works collaboratively across the Company to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company’s incident response and recovery plans. To facilitate the success of the Company’s cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time, and report such threats and incidents to the Risk Capital Management Committee when appropriate.

The CISO has served in various roles in information technology and information security for over 20 years. The CISO holds undergraduate and graduate degrees in computer information systems and has attained the Certified Information Systems Security Professional certification. The CITO has served in various roles in information technology for over 20 years, including serving as Chief Information Officer and providing cybersecurity oversight at private and public sector companies.

Material Effects of Cybersecurity Incidents

Risks as a result of any known cybersecurity threats and incidents have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.