Travelers 2013 Annual Report Download - page 79

experiences an interruption. Business interruptions and failures of controls could also result if our
internal systems do not interface with each other as intended, including as it relates to recently
acquired businesses. If our business continuity plans did not sufficiently address such a business
interruption, system failure or service denial, this could result in a deterioration of our ability to write
and process new and renewal business, provide customer service, pay claims in a timely manner or
perform other necessary business functions.
Our operations rely on the reliable and secure processing, storage and transmission of confidential
and other information in our computer systems and networks. Computer viruses, hackers, employee
misconduct and other external hazards could expose our data systems to security breaches, cyber-
attacks or other disruptions. In addition, we routinely transmit and receive personal, confidential and
proprietary information by e-mail and other electronic means. While we attempt to develop secure
transmission capabilities with third-party vendors and others with whom we do business, we may be
unable to put in place secure capabilities with all of such vendors and third parties and, in addition,
these third parties may not have appropriate controls in place to protect the confidentiality of the
information.
Like other global companies, our computer systems are regularly subject to and will continue to be
the target of computer viruses or other malicious codes, unauthorized access, cyber-attacks or other
computer-related penetrations. While we have experienced threats to our data and systems, to date, we
are not aware that we have experienced a material breach of cyber security. Over time, the
sophistication of these threats continues to increase, however, and our administrative and technical
controls as well as other preventative actions we take to reduce the risk of cyber incidents and protect
our information may be insufficient to detect or prevent unauthorized access, other physical and
electronic break-ins, cyber-attacks or other security breaches to our computer systems or those of third
parties with whom we do business. In addition, new technology that could result in greater operational
efficiency may further expose our computer systems to the risk of cyber-attacks.
We have increasingly outsourced certain technology and business process functions to third parties
and may continue to do so in the future. If we do not effectively develop, implement and monitor our
outsourcing relationships, third party providers do not perform as anticipated or we experience
technological or other problems with a transition, we may not realize expected productivity
improvements or cost efficiencies and may experience operational difficulties, increased costs and a loss
of business. Our outsourcing of certain technology and business process functions to third parties may
expose us to increased risk related to data security or service disruptions, which could result in
monetary and reputational damages. For example, while we do not believe it will materially and
adversely impact our operations or results, we terminated a contract with one of our outsourcing
vendors in the fourth quarter of 2013 because they breached that contract by providing proprietary
Company information to one of our competitors. In addition to risks caused by third party providers,
our ability to receive services from third party providers outside of the United States might be
impacted by cultural differences, political instability, unanticipated regulatory requirements or public
policy inside or outside of the United States.
The increased risks identified above could expose us to data loss, disruption of service, monetary
and reputational damages and significant increases in compliance costs and costs to improve the
security and resiliency of our computer systems. The compromise of personal, confidential or
proprietary information could also subject us to legal liability or regulatory action under data protection
and privacy laws and regulations enacted by the U.S. federal and state governments, the European
Union or other jurisdictions or by various regulatory organizations or exchanges. As a result, our ability
to conduct our business and our results of operations might be materially and adversely affected.
We are subject to a number of risks associated with our business outside the United States. We
conduct business outside the United States primarily in Canada, the United Kingdom and the Republic
69