Company: PBR
Filing Date: 2025-04-03
Form Type: 20-F
Source: 0001292814-25-001352
Chunk: 44

Company: PETROBRAS - PETROLEO BRASILEIRO SA
Filing Date: 2025-04-03
Form: 20-F
Item: Item 17
Chunk 44
---
 appointed by our executive board. The CSI advises on information security matters, aligning them with the National Information Security Policy and our business objectives, with strategic issues discussed quarterly.

 The Security Information Management team holds regular meetings to address operational and strategic concerns, in addition to routine interactions. Monthly discussions are held to monitor key security indicators, management processes and project management.

 
Role of the Board of Directors, Executive Board and Committees

 Our senior management receives periodic reports on risks from Petrobras’ corporate risk matrix based on their assessed severity. These reports include strategic risks and risks of very high and high severity – including those related to cybersecurity and information security. They follow a standardized model with an annual timeline for specific risk management actions, detailing managed risks and main response actions. Senior management also monitors the evolution of the risk matrix and the deadlines for response plans.

 Strategic risks are those business risks that, due to their relevance to meeting our strategic objectives, are monitored by the Executive Board and Board of Directors, which schedule quarterly presentations. Recently, cybersecurity risks have been classified as strategic due to their relevance, interconnectedness and impact on the business.

  
The Board of Directors approves the company’s risk profile and oversees the company’s risk management with advice from the Audit Committee.

 The CSI evaluates and monitors the Information Security Management System, cybersecurity and information security risks, and the execution of risk treatment plans and guidelines.

 The CISO manages information security initiatives, establishes strategies aligned with business objectives and regulation, and recommends investments to mitigate risks and protect critical assets.

 

Annual Report and Form 20-F 2024 |
Cybersecurity Strategy and Risk Management

 Our layered defense approach integrates policies, processes, training, and cybersecurity technology to protect and monitor our environment.

 Our cybersecurity measures are primarily based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. We use NIST best practices to assess our security maturity.

Cyber Defense

 Our incident response plan encompasses preparation, detection, response, and recovery from cybersecurity incidents, ensuring legal compliance and minimizing reputational damage.

 A 24/7 Computer Security Incident Response Team (CSIRT) manages and coordinates responses to cybersecurity events. Significant incidents that could affect investors’ decisions will be promptly reported to the market as required by the SEC.

 We are members of FIRST (Forum of Incident Response and Security Teams), a prominent global forum for cybersecurity teams across various sectors and countries, focusing on prevention and improving global information security.

 We collaborate with global cybersecurity teams, sharing threat intelligence and best practices, and engage in workshops, conferences, and partnerships to