Cosmos Insurance Public Company Ltd recognises that the protection of information is essential to the trust of our policyholders, intermediaries and partners, and to the continuity of our insurance services. The Board of Directors and management are committed to protecting the confidentiality, integrity and availability of the information entrusted to us, including personal, health and financial data.

Our commitments. Cosmos is committed to:

• complying with all applicable legal, regulatory and contractual requirements on cybersecurity and data protection, including the General Data Protection Regulation (GDPR);
• complying with the criteria of the NCC-CY Cyber-Hygiene Framework, and with any amendments and guidelines issued by the Digital Security Authority;
• handling security incidents promptly and informing affected stakeholders and the competent authorities as required;
• implementing the corrective and preventive actions reasonably required by authorised parties, such as auditors and supervisory authorities.

How we protect information. Our Information Security Policy, approved by the Board of Directors, is supported by specific policies and procedures. Our measures include:

• risk-based management of information security;
• strict access control, with multi-factor authentication;
• protection against malware, with continuous monitoring;
• regular security updates, vulnerability scanning and independent penetration testing;
• network and physical security;
• protected backups and tested recovery arrangements;
• incident response and business continuity plans;
• the protection of personal data under the oversight of our Data Protection Officer;
• ongoing security awareness training for all staff.

Our policies are reviewed at least annually and improved continuously.

Point of contact. Our Chief Executive Officer is the point of contact on cybersecurity matters. Stakeholders with a legitimate need may request a copy of our Information Security Policy through the Company’s contact details.