The Hartford 2012 Annual Report Download - page 27

Table of Contents
If we are unable to maintain the availability of our systems and safeguard the security of our data due to the occurrence of disasters or a cyber or
other information security incident, our ability to conduct business may be compromised, we may incur substantial costs and suffer other negative
consequences, all of which may have a material adverse effect on our business, financial condition, results of operations and liquidity.
We use computer systems to process, store, retrieve, evaluate and utilize customer and company data and information. Our computer, information technology
and telecommunications systems, in turn, interface with and rely upon third-party systems or third-parties firms to maintain our systems. Our business is
highly dependent on our ability, and the ability of certain third parties, to access these systems to perform necessary business functions, including, without
limitation, conducting our financial reporting and analysis, providing insurance quotes, processing premium payments, making changes to existing policies,
filing and paying claims, administering variable annuity products and mutual funds, providing customer support and managing our investment portfolios
and hedging programs.
Systems failures or outages could compromise our ability to perform our business functions in a timely manner, which could harm our ability to conduct
business and hurt our relationships with our business partners and customers. In the event of a disaster such as a natural catastrophe, a pandemic, an
industrial accident, a blackout, a terrorist attack or war, systems upon which we rely may be inaccessible to our employees, customers or business partners
for an extended period of time. Even if our employees and business partners are able to report to work, they may be unable to perform their duties for an
extended period of time if our data or systems used to conduct our business are disabled or destroyed.
Moreover, our computer systems have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access, cyber-
attacks or other computer related penetrations. While, to date, The Hartford has not experienced a material breach of cybersecurity, administrative and
technical controls as well as other preventive actions we take to reduce the risk of cyber incidents and protect our information technology may be insufficient to
prevent physical and electronic break-ins, denial of service and other cyber-attacks or other security breaches to our computer systems. Such an event could
compromise our confidential information as well as that of our clients and third parties with whom we interact, impede or interrupt our business operations
and may result in other negative consequences, including remediation costs, loss of revenue, additional regulatory scrutiny and litigation and reputational
damage.
In addition, we routinely transmit, receive and store personal, confidential and proprietary information by email and other electronic means. Although we
attempt to keep such information confidential, we may be unable to utilize such capabilities in all events, especially with clients, vendors, service providers,
counterparties and other third parties who may not have or use appropriate controls to protect confidential information.
Furthermore, certain of our businesses are subject to compliance with regulations enacted by U.S. federal and state governments, the European Union, Japan
or other jurisdictions or enacted by various regulatory organizations or exchanges relating to the privacy of the information of clients, employees or others. A
misuse or mishandling of confidential or proprietary information being sent to or received from an employee or third party could result in legal liability,
regulatory action and reputational harm.
Third parties to whom we outsource certain of our functions are also subject to the risks outlined above, any one of which may result in our incurring
substantial costs and other negative consequences, including a material adverse effect on our business, financial condition, results of operations and liquidity.
While we maintain cyber liability insurance that provides both third party liability and first party insurance coverages, our insurance may not be sufficient to
protect against all loss.
Our framework for managing operational risks may not be effective in mitigating risk and loss to us that could adversely affect our businesses.
Our business performance is highly dependent on our ability to manage operational risks that arise from a large number of day-to-day business activities,
including insurance underwriting, claims processing, servicing, investment, financial and tax reporting, compliance with regulatory requirements and other
activities, many of which are very complex and for some of which we rely on third parties. We seek to monitor and control our exposure to risks arising out of
these activities through a risk control framework encompassing a variety of reporting systems, internal controls, management review processes and other
mechanisms. We cannot be completely confident that these processes and procedures will effectively control all known risks or effectively identify unforeseen
risks, or that our employees and third-party agents will effectively implement them. Management of operational risks can fail for a number of reasons,
including design failure, systems failure, failures to perform, cyber security attacks, human error, or unlawful activities on the part of employees or third
parties. In the event that our controls are not effective or not properly implemented, we could suffer financial or other loss, disruption of our businesses,
regulatory sanctions or damage to our reputation. Losses resulting from these failures can vary significantly in size, scope and scale and may have material
adverse effects on our financial condition or results of operations.
27