Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 499

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 499
---
 an ever- changing cyber security threat landscape, to provide a safe, stable and secure technology platform.

| Objective 1: Maintain a ”best-in-class” cyber securitycapabilityContinue to uplift and align our cyber securitycapabilities with industry standards through ongoingassurance and benchmarking.                                    |
| Objective 2: Realise and sustain essential controlimprovements for our core technology platformsEmbed robust frameworks for continuousmonitoring, assurance and improvement of thecyber security operational control environment. |
| Objective 3: Build a culture of cyber securityresilience and consciousnessIncrease our visibility and security consciousness,and ensure everyone is aware of and understandstheir responsibilities and obligations.               |
| Objective 4: Secure our digital futureAdopt effective cyber control measures in new andemerging technologies critical to our digital future.                                                                                      |

Our Cyber Security Strategy requires ongoing investment to embed and sustain cyber security capabilities and controls, to best support our operations as cyber threats continue to rapidly evolve. We develop a plan each year detailing the initiatives, investment and goals we will deliver, aligned to each of the 4 pillars of the Strategy. At the beginning of each financial year, the Cyber Security Steering Committee (CSSC), a management committee chaired by the Chief Financial Officer, endorses the plan. Detailed quarterly plans are then prepared to communicate our goals to the wider Cyber Security team, and the milestones we will need to meet to accomplish these goals. This provides the Cyber Security function with a structured way to ensure clarity on priorities and accountabilities, and a way to measure progress throughout the year. Major initiatives and improvement objectives for 2025 relate to improving Operational Technology (OT) endpoint detection and response, securing remote access to process control networks, and strengthening privileged identity management controls in OT networks. Governance Accountability for the effective management of cyber security risks and events rests with Executive Management. In addition to functional oversight, management has established a Cyber Security Steering Committee comprising a multi-disciplinary team of senior executives who monitor current and evolving cyber security risks and the effectiveness of measures taken to respond to them . The Board oversees our material risks, and the Audit & Risk Committee monitors the overall effectiveness of our risk management and internal controls framework. Exposures to cyber security risks are managed consistent with other material Group risks, and are reported to the Board, Audit & Risk Committee and the Executive Committee. Refer to Our approach to risk management on page 88 for further details . Our Cyber Security function is overseen by the CSSC. The remit of the function is defined within our Group Procedure