Business ProfileforAnthem, Inc.

On Semptember 30, 2020, Anthem, Inc. entered into an Assurance of Voluntary Compliance with the Attorneys General of Indiana and multiple other states to resolve the Attorneys General investigation into the criminal cyberattack on Anthem's systems, which Anthem publicly announced on February 4, 2015. Nothing in the assurance is intended to be and shall not be construed or deemed to be an admission or concession or evidence of any liability or wrongdoing whatsoever on the part of Anthem or of any fact or violation of any law, rule, or regulation. The Assurance of Voluntary Compliance requires Anthem, Inc. to pay Thirty-Nine Million and Five Hundred Thousand Dollars ($39,500,000.00) to the Attorneys General. In addition to this payment, Anthem agreed to a series of provisions designed to strengthen its security practices. Those provisions include: 

• Prohibiting misrepresentations about the extent to which Anthem protects the privacy and security of personal information; 
• Implementing a comprehensive information security program that incorporates principles of zero-trust architecture. This includes regularly reporting security matters to the Board of Directors and promptly notifying the CEO of significant security threats; 
• Implementing security requirements with respect to segmentation, logging and monitoring, anti-virus maintenance, access controls and two-factor authentication, encryption, risk assessments, penetration testing and employee training, among other requirements; and 
• Conducting third-party security assessments and audits for three years, as well as requiring that Anthem make its risk assessments available to a third-party assessor during that term.