Travelers 2012 Annual Report Download - page 76

of our facilities (including our primary data processing facility); a power outage; or a failure of one or
more of our information technology, telecommunications or other systems could significantly impair our
ability to perform such functions on a timely basis, particularly if such an interruption lasts for an
extended period of time. In the event of a disaster such as a natural catastrophe, terrorist attack or
industrial accident, or due to a computer virus, our systems could be inaccessible for an extended
period of time. In addition, because our information technology and telecommunications systems
increasingly interface with and depend on third-party systems, we could experience service denials or
failures of controls if demand for our service exceeds capacity or a third-party system fails or
experiences an interruption. If our business continuity plans did not sufficiently address such a business
interruption, system failure or service denial, this could result in a deterioration of our ability to write
and process new and renewal business, provide customer service, pay claims in a timely manner or
perform other necessary business functions.
Our operations rely on the reliable and secure processing, storage and transmission of confidential
and other information in our computer systems and networks. Computer viruses, hackers, employee
misconduct and other external hazards could expose our data systems to security breaches, cyber-
attacks or other disruptions. In addition, we routinely transmit and receive personal, confidential and
proprietary information by e-mail and other electronic means. While we attempt to develop secure
transmission capabilities with third-party vendors and others with whom we do business, we may be
unable to put in place secure capabilities with all of such vendors and third parties and, in addition,
these third parties may not have appropriate controls in place to protect the confidentiality of the
information.
Our computer systems have been and will likely continue to be, subject to computer viruses or
other malicious codes, unauthorized access, cyber-attacks or other computer-related penetrations.
While, to date, we are not aware that we have experienced a material breach of cyber security,
administrative and technical controls as well as other preventative actions we take to reduce the risk of
cyber incidents and protect our information may be insufficient to prevent physical and electronic
break-ins, cyber-attacks or other security breaches to our computer systems or those of third parties
with whom we do business. In addition, new technology that could result in greater operational
efficiency may further expose our computer systems to the risks of cyber-attacks. We may forego the
implementation of such new technology to limit this additional risk.
These increased risks, and expanding regulatory requirements regarding data security, could expose
us to data loss, disruption of service, monetary and reputational damages and significant increases in
compliance costs and costs to improve the security and resiliency of our computer systems. As a result,
our ability to conduct our business might be adversely affected.
We have increasingly outsourced certain technology and business process functions to third parties
and may continue to do so in the future. If we do not effectively develop, implement and monitor our
outsourcing relationships, third party providers do not perform as anticipated or we experience
technological or other problems with a transition, we may not realize expected productivity
improvements or cost efficiencies and may experience operational difficulties, increased costs and a loss
of business. Our outsourcing of certain technology and business process functions to third parties may
expose us to increased risk related to data security or service disruptions, which could result in
monetary and reputational damages. In addition, our ability to receive services from third party
providers outside of the United States might be impacted by cultural differences, political instability,
unanticipated regulatory requirements or policies inside or outside of the United States. As a result,
our ability to conduct our business might be adversely affected.
64