Company: CRESW
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001654954-25-012195
Chunk: 409

Company: CRESUD INC
Filing Date: 2025-10-24
Form: 20-F
Item: Item 16
Chunk 409
---
, who has over 20 years of experience in the cybersecurity sector. He has deep knowledge in telecommunications, security awareness, access control, and technological risks. He has participated in information security training programs such as CISM (Certified Information Security Manager) and CISSP (Certified Information Systems Security Professional) and is responsible for evaluating and managing cybersecurity risks. Our information security management team is independent of our IT management and is integrated into our compliance management. This information security management has an individual annual budget, and a strategy which is based on two principles: (i) the continuous review and improvement of our information security model; and (ii) a cybersecurity framework based on the National Institute of Standards and Technology (NIST).

This strategy allows us to identify, protect, detect, respond to, and recover our systems and data from potential threats, and it is under constant evaluation. This strategy also ensures the proper integration of security into business processes, minimizing risks and impacts that could materially affect us or our subsidiaries. 

Within this corporate governance model, there are preventive controls and processes that allow us to supervise and monitor our corporate information security strategy and carry out investments and initiatives that enable us to achieve our business objectives.

264
Cybersecurity

In response to the evolving cyber threats, we have undertaken several projects to improve our security systems. During 2024 and 2025, we carried out actions that allowed us to enhance the maturity level of our control systems based on internationally recognized cybersecurity best practices. Additionally, we identified residual risks and deepened cybersecurity awareness among our employees. We updated our users’ equipment fleet and centralized our patch management through world-class solutions that allow us to keep devices on their latest versions, covering the vulnerabilities published by manufacturers. These actions have enabled better incident management, increased protection against threats, and built an adequate cybersecurity environment for the organization.

In response to the evolution of cyber threats, we have external advisors with over 25 years of experience in the cybersecurity field who provide us with vulnerability assessment services, customized training, and protection recommendations against cyber threats. Additionally, we work with business partners who provide us with advanced tools for early threat detection, allowing us to identify potential cybersecurity risks.

Our main Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) systems have the levels of protection and contingency recovery that allow us to be prepared for the constant evolution of cyberattacks. During 2024 and 2025, we have carried out the following actions: (i) we conducted a risk analysis that allows us to identify residual risks to be