The Global Atlantic Financial Group LLC and its subsidiaries (“Global Atlantic”) maintain a high-priority focus on crisis management, business continuity, information security incident response and disaster recovery in the event of an unexpected disruption to operations. Plans and processes are documented and in place related to proper management of unforeseen events that have a significant impact on Global Atlantic’s systems and their ability to facilitate normal business operations. Significant negative events can include anything that puts Global Atlantic’s operations at risk, both natural and man-made disasters.

The Crisis Management Team is comprised of employees from several different departments, each with clearly defined roles and responsibilities. In the event of a business disruption affecting one or more of Global Atlantic’s office locations, associated Business Continuity representatives will implement a recovery strategy based on the severity and nature of the incident. Global Atlantic anticipates that it will be able to continue business in the event of a crisis affecting one of its facilities by relocating necessary personnel, transferring work to another office, or having key personnel work from home – a core component of Global Atlantic’s strategy. All Global Atlantic employees have the ability to connect to the corporate network allowing them to work anywhere there is an Internet connection.

Contractual agreements are in place with application service providers to assure they can provide necessary support in the event of any interruption to Global Atlantic-based services. The Business Continuity Program (“BCP”) also strives to assure that third party administrators maintain current business continuity and disaster recovery plans for their operations.

Global Atlantic maintains geographically dispersed locations for hosting in-house production systems. In accordance with documented backup procedures, all production systems are backed up to an alternate location on a regular cycle. Recovery tests for each of these systems are performed at least once per year. If any test fails initially, corrective measures will be put in place and retested until successful.

Significant business disruption events are managed by the Global Atlantic Crisis Management team. All external communications, including customer advisories, are handled according to the established protocol.



Statement Owner (Department): Corporate Services

Statement Owner (Individual): Rob Shickel

Effective Date: May 28, 2024