Company: CTTRF
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001292814-25-001765
Chunk: 285

Company: Controladora Vuela Compania de Aviacion, S.A.B. de C.V.
Filing Date: 2025-04-30
Form: 20-F
Item: Item 16J
Chunk 285
---
 materially affected or are reasonably likely to materially
affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from
cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results
of operations, or financial condition. See “ Risk Factors - Cyber-attacks or other cyber-incidents involving our IT Systems and
Confidential Information could have an adverse effect on our business, results of operations, or financial condition.”

  166  

  Table of Contents  

Cybersecurity Governance

Cybersecurity risk is part of our overall risk oversight
function. The board of directors has entrusted the audit committee with the oversight of cybersecurity and other information technology
risks.

The audit committee, oversees the implementation of our cybersecurity
risk management program, supported by our Technology & Transformation Senior Director and the IT and Cybersecurity Working Group. This multidisciplinary group is comprised of executive management members as well as key leaders from internal audit, risk evaluation,
financial planning, compliance, IT, and technology domains, alongside external advisors.

Quarterly
reports from the IT and Cybersecurity Working Group provide theaudit
committeewith
assessments of our cybersecurity risks and risk remediation and management initiatives. Additionally,
management updates theaudit committeeon significant cybersecurity incidents.

Continuing education remains a cornerstone of our governance
approach, with the audit committee receiving briefings on cybersecurity topics from our Technology & Transformation Senior Director,
internal security staff, or external experts.

Key strategic and operational initiatives are led by our
Technology & Transformation Senior Director, the IT senior manager, the senior transformation manager, the IT internal control manager,
and the IT security manager who are primarily responsible for assessing and managing cybersecurity risks. These individuals are skilled
in risk management, data safety, control design, and cybersecurity operations management. Our Technology & Transformation Senior Director
has over 30 years of experience in control areas, risk management and compliance including the last four years focused on IT, cybersecurity
and digital transformation. Our IT senior manager has over 30 years of experience in IT management with a background in infrastructure,
support and administration of mission-critical systems. Our Senior Transformation Manager has over 24 years of experience spearheading
transformation initiatives focused on business processes and needs. Finally, our IT Internal Control Manager has over 24 years of experience
in IT and cybersecurity controls, risk management and regulatory compliance.

In addition, various operational cybersecurity team members
hold certifications in ISO270