Cybersecurity Program & Policy

Cybersecurity Program

Dominion Insurance Services (“Dominion”) maintains a comprehensive cybersecurity program designed to protect the confidentiality, integrity, and availability of Dominion’s Information Systems and the Nonpublic Information they contain.

This program is risk-based and aligned with Dominion’s periodic Risk Assessments, ensuring that cybersecurity controls evolve with emerging threats, technology changes, and regulatory requirements.

The program is designed to perform the following core cybersecurity functions:

Identify and assess internal and external cybersecurity risks that may threaten the security or integrity of Nonpublic Information and Information Systems.

Protect Information Systems and Nonpublic Information through defensive infrastructure, secure configuration, encryption, and the implementation of policies, standards, and procedures.

Detect potential and actual Cybersecurity Events through continuous monitoring, logging, and alerting.

Respond promptly to identified or detected Cybersecurity Events in order to mitigate negative effects and contain further impact.

Recover from Cybersecurity Events and restore normal operations and services while minimizing downtime and data loss.

Report and fulfill applicable legal, contractual, and regulatory notification and reporting obligations.

Core Safeguards

To support the above objectives, Dominion maintains the following safeguards:

Endpoint protection (virus detection, anti-malware, and intrusion prevention software) on all servers, workstations, and mobile devices that access Nonpublic Information.

Encrypted firewalls and network segmentation to protect against unauthorized access.

Multi-factor authentication (MFA) and strict access controls for all privileged and remote accounts.

Encryption of Nonpublic Information both in transit and at rest, wherever feasible.

Limited and controlled internet access on systems containing Nonpublic Information.

Regular patch management and system updates to address vulnerabilities.

Security awareness training for all employees and contractors with access to Information Systems.

All documentation and information relevant to Dominion’s cybersecurity program shall be maintained and made available to regulators upon request.

Cybersecurity Policy

The following constitutes Dominion’s implemented, written cybersecurity policies, formally approved by Dominion’s President. These policies set forth Dominion’s framework for the protection of Information Systems and Nonpublic Information, based on Dominion’s Risk Assessments and aligned with applicable laws and industry standards.

Policy Elements

Dominion’s cybersecurity policy includes, at a minimum, the following elements:

Information Security Governance – Roles, responsibilities, and oversight for cybersecurity management.

Data Governance and Classification – Classification of data by sensitivity and required protection measures.

Asset Inventory and Device Management – Maintenance of an accurate inventory of hardware, software, and data assets.

Access Controls and Identity Management – Strong authentication, role-based access, and periodic reviews of user entitlements.

Business Continuity and Disaster Recovery Planning – Documented procedures, backup strategies, and recovery resources.

Systems Operations and Availability – Procedures to maintain system performance, availability, and resilience.

Network and Systems Security – Firewalls, intrusion detection/prevention, endpoint protection, and secure configuration standards.

Systems and Network Monitoring – Continuous logging, monitoring, and alerting to detect anomalous activity.

Secure Systems and Application Development – Security testing, change management, and quality assurance practices.

Physical Security and Environmental Controls – Controlled access to offices, data centers, and sensitive environments.

Customer Data Privacy – Safeguards for confidentiality and lawful use of customer Nonpublic Information.

Vendor and Third-Party Risk Management – Due diligence, contract requirements, and monitoring of service providers.

Ongoing Risk Assessment – Regular reassessment of cybersecurity risks and the effectiveness of security controls.

Incident Response – Formal plan for identifying, escalating, managing, and communicating cybersecurity incidents.

Enforcement

To implement and enforce these objectives, Dominion:

Installs and maintains endpoint protection and monitoring tools on all servers and computers storing Nonpublic Information.

Maintains encrypted firewalls and access controls across all Information Systems.

Limits and monitors internet access on systems containing sensitive data.

Requires MFA for remote and administrative access.

Conducts annual cybersecurity training for all personnel and regular phishing simulations to reinforce best practices.

Reviews, updates, and tests cybersecurity policies, procedures, and response plans at least annually, or more frequently as risks evolve.

This Progam and Policy has been initially approved by the Board of Directors and will be reviewed and reapproved annually on or before July 1st.

© 2025 Dominion Insurance Services, Inc. & First Dominion Corporation. All rights reserved.