XML 46 R31.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management and Strategy The Company’s cybersecurity approach comprises a holistic strategy that includes comprehensive security policies and standards, a robust security awareness and education program, and the implementation of advanced and layered defenses, which is integrated into the Company's overall risk management processes. Our cybersecurity program is aligned with generally accepted principles and practices for securing information systems and data. The program is designed to comply with applicable laws and regulations and is based on many industry best practices. For instance, our cybersecurity program, policies and controls align to those of the National Institute of Standards and Technology’s Cybersecurity Framework. We have established and continue to enhance our procedures for identifying cybersecurity risks and implementing defenses to mitigate these risks. We devote significant resources to maintaining and regularly updating our systems and processes to protect the security of our computer systems, software, networks and other technology assets against unauthorized parties attempting to access confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. Our cyber incident response plan provides procedures and controls for timely and accurate reporting of any material cybersecurity incident, and each associate is educated, trained and tested on cybersecurity to help be our first line of defense. We have a dedicated Cybersecurity Services team ("CST") devoted to information security which is led by the chief information security officer ("CISO"). In addition, our Security Operations Center provides near-real-time monitoring of network traffic going in and out of the enterprise to identify any abnormalities or indications of malicious behavior. We use managed security services providers to provide monitoring, threat hunting and response services through network and security log monitoring and a hosted security information and event management solution. We conduct regular enterprise-wide internal and external cyber risk assessments. These efforts include audits, internal and external regulatory compliance assessments, and periodic self-assessments. Vulnerability assessments are performed frequently for systems, and internal and external penetration tests are performed annually. We periodically engage vendors to review and benchmark our cybersecurity processes. In addition, members of the CST perform regular security control assurance testing. Our internal audit department also reviews our cybersecurity program, processes, policies and controls at least annually. The program also is regularly reviewed in annual external audits and regulatory assessments. Lessons learned from those efforts are used to drive improvements to continually strengthen the cybersecurity program, including controls for data security. The CST works closely with the sourcing and vendor management team when contracting for third-party information technology services. Our information technology architecture review board, which includes cybersecurity leadership, reviews all potential vendors. We have comprehensive cybersecurity assessment processes and procedures in place, including security risk questionnaires, standard documentation requests, and utilization of a third-party risk evaluation tool to provide insight on potential third-party vendors. We utilize private connections (including private VPN) and extensive use of virtual desktops to secure access to our data and systems. Our legal team ensures that specific protections are included in contracts, including confidentiality language, nondisclosure obligations and security provisions. Critical vendors are monitored by our sourcing and vendor management team. Resources contracted through a third-party that will have access to corporate systems must complete CNO's associate training or their company’s security awareness training that has been approved by CNO. We also perform periodic risk assessments throughout the term of the engagements, including those third parties located outside the United States that have access to our Company and customer information. As of December 31, 2024, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.
Cybersecurity Risk Management Processes Integrated [Flag] | false
Cybersecurity Risk Management Processes Integrated [Text Block] | We have established and continue to enhance our procedures for identifying cybersecurity risks and implementing defenses to mitigate these risks. We devote significant resources to maintaining and regularly updating our systems and processes to protect the security of our computer systems, software, networks and other technology assets against unauthorized parties attempting to access confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. Our cyber incident response plan provides procedures and controls for timely and accurate reporting of any material cybersecurity incident, and each associate is educated, trained and tested on cybersecurity to help be our first line of defense.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology. Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 24 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications. Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident. For a discussion regarding risks associated with cybersecurity threats, see Risk Factors – General Business Risk – "Interruption in telecommunication, information technology and other operational systems, or a failure to maintain the security, confidentiality or privacy of sensitive data residing on such systems, could harm our business," and "The use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase the operational risks discussed above, or create new or unanticipated operational risks."
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology.
Cybersecurity Risk Role of Management [Text Block] | We have a dedicated Cybersecurity Services team ("CST") devoted to information security which is led by the chief information security officer ("CISO"). In addition, our Security Operations Center provides near-real-time monitoring of network traffic going in and out of the enterprise to identify any abnormalities or indications of malicious behavior. We use managed security services providers to provide monitoring, threat hunting and response services through network and security log monitoring and a hosted security information and event management solution. We conduct regular enterprise-wide internal and external cyber risk assessments. These efforts include audits, internal and external regulatory compliance assessments, and periodic self-assessments. Vulnerability assessments are performed frequently for systems, and internal and external penetration tests are performed annually. We periodically engage vendors to review and benchmark our cybersecurity processes. In addition, members of the CST perform regular security control assurance testing. Our internal audit department also reviews our cybersecurity program, processes, policies and controls at least annually. The program also is regularly reviewed in annual external audits and regulatory assessments. Lessons learned from those efforts are used to drive improvements to continually strengthen the cybersecurity program, including controls for data security. The CST works closely with the sourcing and vendor management team when contracting for third-party information technology services. Our information technology architecture review board, which includes cybersecurity leadership, reviews all potential vendors. We have comprehensive cybersecurity assessment processes and procedures in place, including security risk questionnaires, standard documentation requests, and utilization of a third-party risk evaluation tool to provide insight on potential third-party vendors. We utilize private connections (including private VPN) and extensive use of virtual desktops to secure access to our data and systems. Our legal team ensures that specific protections are included in contracts, including confidentiality language, nondisclosure obligations and security provisions. Critical vendors are monitored by our sourcing and vendor management team. Resources contracted through a third-party that will have access to corporate systems must complete CNO's associate training or their company’s security awareness training that has been approved by CNO. We also perform periodic risk assessments throughout the term of the engagements, including those third parties located outside the United States that have access to our Company and customer information.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | We have a dedicated Cybersecurity Services team ("CST") devoted to information security which is led by the chief information security officer ("CISO").
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 24 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration