Verisk Analytics VRSK · USD

Item 1C.Cybersecurity We remain steadfast in our commitment to safeguarding the confidentiality, integrity, availability, and responsible use of data. Our rigorous approach to cybersecurity is a comprehensive framework comprising cyber risk governance, risk identification and management, risk prevention and protection, monitoring and detection, and response and recovery planning, which is an integral part of our overall enterprise risk management ("Framework"). Cyber risk governance is founded on direction and priorities established by our leadership, supported and overseen by the Board of Directors ("Board"), and deployed through our Framework. The Framework leverages proven standards such as those embedded in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), which are generally accepted by cybersecurity leaders across industries. The Board oversees our management of cybersecurity, including oversight of appropriate risk mitigation strategies. The Board receives regular reports from executives about our cybersecurity risks, management review processes, overall health and readiness to respond to an incident. The Risk Committee of the Board was established in February 2024 to oversee risk assessment and risk management of the Company in coordination with other relevant Board Committees as appropriate, including but not limited to the policies, procedures and strategic approach to cyber, technology and information security risks. The Risk Committee of the Board also reports material cybersecurity risks to our full Board. The Executive Risk Management Committee ("ERMC"), which includes the top corporate executives, is responsible for providing guidance and enforcing our Framework, including the strategies, policies, procedures, processes, and systems, established by management to identify, assess, measure, monitor, and manage risks. The ERMC also reinforces the corporate risk appetite, determines whether residual risk is acceptable, and confirms materiality of security incidents. The Enterprise Risk Management ("ERM") division of the Company oversees and advises on implementation of the Framework throughout our business units. In doing so, the ERM division aggregates and assesses risk across the enterprise. Coordinating with the ERM division is the Chief Information Security Officer ("CISO"), who leads our Cybersecurity and Information Risk Management functions.

(b) Revenue Recognition The following describes our primary types of revenues and the applicable revenue recognition policies. We recognize revenues through recurring and non-recurring long-term agreements (generally one to five years) for hosted subscriptions, advisory/consulting services, and for transactional solutions. Our revenues are primarily derived from the sale of services where revenue is recognized when or as control of the promised services is transferred to customers in an amount that reflects the consideration that we expect to be entitled to in exchange for those services. Fees for services provided by us are non-refundable. Revenue is recognized net of applicable sales tax withholdings. Hosted Subscriptions We offer hosted subscriptions, where customers access content only through our online portal (the "Hosted Subscription"). We grant a license to our customer to enter our online portal. The license is a contractual mechanism that allows our customer to access our online portal for a defined period of time. As the license alone does not provide utility to our customer, our customer has no contractual right to take possession of our online portal at any time, and our customer cannot engage another party to host our online portal and related content, it is not considered a functional license under ASC 606, Revenue from Contracts with Customers ("ASC 606"). Our promise to our customer is to provide continuous access to our online portal and to update the content throughout the subscription period. Hosted Subscription is a single performance obligation that represents a series of distinct services (daily access to our online portal and related content) that are substantially the same and that have the same pattern of transfer to our customer. We recognize revenue for Hosted Subscriptions ratably over the performance obligation period on a straight-line basis as services are performed and continuous access to information in our online portal is provided over the entire term of the agreements. Subscriptions are generally paid in advance of rendering services either quarterly or annually upon commencement of the performance obligation period.