Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 500

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 500
---
 for Information and Cyber Security . Specific expectations for all employees are detailed within our Acceptable Use of Information and Electronic Resources Group Standard , and our employee Code of Conduct, The Way We Work. For external assurance, we commission independent assessment and benchmarking against the US National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), upon which our internal standards are based. These reviews are conducted by consultancies specialising in cyber security and include penetration testing and the simulation of external attacks on our information security. Capabilities of our Cyber Security function:

| Threat intelligence       | Understanding the latest cyber security threats and assessing our potential exposure.                                                                                                                        |
| Vulnerabilitymanagement   | Maintaining awareness of, and continuously resolving, security vulnerabilities before they can be exploited, including a dedicated internalfunction to test our defences against the latest vulnerabilities. |
| Security risk andadvisory | Ensuring information technology (IT) projects and changes stay within our risk appetite by assessing and advising on appropriate andeffective cybersecurity controls.                                        |
| Security operations       | Keeping core information security platforms and services available, accessible and operating effectively at all times.                                                                                       |
| Security architecture     | Ensuring solution designs and our overall technology architecture are in line with good cyber security practice to be robust, resilient, andsustainable.                                                     |
| Incident response         | Persistent monitoring, alerting and triage of cyber security events. As required, initiating appropriate responses to contain threats,resolve vulnerabilities, and recover services.                         |
| Cyber governance          | Facilitating the definition, dissemination and monitoring of our security policies, standards and control environment.                                                                                       |
| Education andawareness    | Educating employees and third parties we work with about keeping information technology secure and being vigilant against socialengineering.                                                                 |

| Annual Report on Form 20-F 2024 | 336 | riotinto.com |

Additional information | US Disclosure

Board The Board, supported by the Audit & Risk Committee, is responsible for overseeing our material risks, including those related to cyber security. The Audit & Risk Committee receives periodic updates on cyber security from management. Cyber security is also subject to a comprehensive assurance program, the rules of which are reported to the Audit & Risk Committee in line with standard processes for reporting assurance findings. This annual update is also reviewed by the Board. Management Our Cyber Security function operates

under the direction of our Chief Information

Security Officer (CISO), who executes

strategic direction and leads the function.

The CISO reports directly to the Chief

Information Officer (CIO