Our robust vulnerability identification, assessment and management program includes system hardening, scanning, alerting, operating system and application patch management Track, assess and remediate security vulnerabilities and emerging threats according to risk priority Static and dynamic security application testing is a core capability of our software development lifecycle External penetration tests of our systems and applications and continuous monitoring our external attack surface Patch systems regularly and track, assess for risk, test and deploy patches or hot fixes to known vulnerabilities Board oversight While the Audit Committee regularly reviews Marsh McLennan’s policies and practices with respect to risk assessment and risk management, including cybersecurity and privacy risk, the full Board also receives regular briefings regarding cybersecurity and privacy matters.