The Hartford 2013 Annual Report Download - page 27

27
Systems failures or outages could compromise our ability to perform our business functions in a timely manner, which could harm our
ability to conduct business and hurt our relationships with our business partners and customers. In the event of a disaster such as a
natural catastrophe, a pandemic, an industrial accident, a blackout, a terrorist attack or war, systems upon which we rely may be
inaccessible to our employees, customers or business partners for an extended period of time. Even if our employees and business
partners are able to report to work, they may be unable to perform their duties for an extended period of time if our data or systems used
to conduct our business are disabled or destroyed.
Moreover, our computer systems have been, and will likely continue to be, subject to computer viruses or other malicious codes,
unauthorized access, cyber-attacks or other computer related penetrations. While, to date, The Hartford is not aware of having
experienced a material breach of cybersecurity, administrative and technical controls as well as other preventive actions we take to
reduce the risk of cyber incidents and protect our information technology may be insufficient to prevent physical and electronic break-
ins, denial of service, cyber-attacks or other security breaches to our computer systems or those of third parties with whom we do
business. Such an event could compromise our confidential information as well as that of our clients and third parties with whom we
interact, impede or interrupt our business operations and may result in other negative consequences, including remediation costs, loss of
revenue, additional regulatory scrutiny and litigation and reputational damage.
In addition, we routinely transmit, receive and store personal, confidential and proprietary information by email and other electronic
means. Although we attempt to keep such information confidential, we may be unable to utilize such capabilities in all events, especially
with clients, vendors, service providers, counterparties and other third parties who may not have or use appropriate controls to protect
confidential information.
Furthermore, certain of our businesses are subject to compliance with regulations enacted by U.S. federal and state governments, the
European Union, Japan or other jurisdictions or enacted by various regulatory organizations or exchanges relating to the privacy of the
information of clients, employees or others. A misuse or mishandling of confidential or proprietary information being sent to or received
from an employee or third party could result in legal liability, regulatory action and reputational harm.
Third parties to whom we outsource certain of our functions are also subject to the risks outlined above, any one of which may result in
our incurring substantial costs and other negative consequences, including a material adverse effect on our business, financial condition,
results of operations and liquidity.
While we maintain cyber liability insurance that provides both third party liability and first party insurance coverages, our insurance may
not be sufficient to protect against all loss.
Our framework for managing operational risks may not be effective in mitigating risk and loss to us that could adversely affect our
businesses.
Our business performance is highly dependent on our ability to manage operational risks that arise from a large number of day-to-day
business activities, including insurance underwriting, claims processing, servicing, investment, financial and tax reporting, compliance
with regulatory requirements and other activities, many of which are very complex and for some of which we rely on third parties. We
seek to monitor and control our exposure to risks arising out of these activities through a risk control framework encompassing a variety
of reporting systems, internal controls, management review processes and other mechanisms. We cannot be completely confident that
these processes and procedures will effectively control all known risks or effectively identify unforeseen risks, or that our employees and
third-party agents will effectively implement them. Management of operational risks can fail for a number of reasons, including design
failure, systems failure, failures to perform, cyber security attacks, human error, or unlawful activities on the part of employees or third
parties. In the event that our controls are not effective or not properly implemented, we could suffer financial or other loss, disruption of
our businesses, regulatory sanctions or damage to our reputation. Losses resulting from these failures can vary significantly in size,
scope and scale and may have material adverse effects on our financial condition or results of operations.