Strong Corporate
Governance

Diversity Is a Cornerstone Value and Priority

Enterprise Risk Management

Elevance Health's risk management processes and execution are managed by a strongly defined governance and risk framework. Varying levels of risk are handled at the appropriate level of management, coordinated among the different risk management functions, and escalated rapidly when appropriate based on well-communicated thresholds.

Our Approach to Supplier Diversity

Supplier diversity contributes to upholding our core values and is one important way we can promote the economic health of our communities. Diversity in our supply chain further supports our ability to develop equitable and competent solutions for affiliated health plan members and the business communities in which we operate. To help address health inequities and strengthen communities, we create strategic local and national partnerships that reflect the diversity of our health plan members and associates.

Data Protection and Cybersecurity

Elevance Health is committed to safeguarding the sensitive data of the organization and the consumers we serve. We are focused on maintaining trust and confidence with a cybersecurity team that is continually assessing and strengthening our defenses, while actively innovating solutions for the future. The program's focus is to:

• Prioritize equipping associates with the necessary tools and skills to support the Information Security Program.
• Provide annual security awareness training covering topics such as social engineering, phishing, password protection, confidential data protection, acceptable asset use, and mobile security.
• Implement a comprehensive privacy-incident response and prevention program, emphasizing the importance of immediate reporting of all incidents.
• Ensure every incident is thoroughly reviewed.
• Take appropriate actions to address any issues identified during the review of incidents.
• Mitigate any potential impact arising from the incidents.
• Assess obligations to notify consumers, clients, regulators, the media and others about any significant incidents.