Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 220

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 16K
Chunk 220
---
 and improving the security posture, our CISO and his team known as Information Security Group (ISG) are committed to fortifying the cyber security cause. CISO and ISG are responsible for identifying, detecting, assessing, and mitigating potential risks and threats related to information technology systems, network, and data and ensuring that necessary cybersecurity policies, processes and practices are established and implemented. CISO orchestrates close collaboration between multiple teams within the ISG such as the Cyber Defense Centre, Technical Operations, Business Security, and Risk Management, and reviews various areas including the cyber threat landscape, security incidents and risks, cybersecurity metrics, and technology implementations, and helps in making key decisions and strategic improvements.
 
Infosys has established a Risk Management Committee (RMC) at the Board level, composed exclusively of independent directors. This committee assists the Board in fulfilling its corporate governance responsibilities, particularly in the identification, evaluation, and mitigation of strategic, operational, and external environment risks. The RMC holds overall responsibility for monitoring, evaluating, and approving the Enterprise Risk Management (ERM) framework and associated practices of the company. Under the RMC, the Board has constituted a Cybersecurity Risk Subcommittee (Subcommittee), which includes four independent directors. The Subcommittee's objective is to assess cybersecurity-related risks and evaluate the company's preparedness to mitigate and respond to such risks.

A high-level working group, the Information Security Council (ISC), has been established to govern and oversee the Information Security Management System at Infosys. The ISC serves as the primary governing body for information security at Infosys, focusing on the establishment, direction, and monitoring of the information security governance framework. It reports to both the Operational Risk Council and the Legal & Compliance Risk Council.

The ISC convenes periodically to discuss cybersecurity and other information security matters relevant to the company, ensuring adherence to the information security program. The Cybersecurity Risk Subcommittee receives updates from the company's management regarding cybersecurity matters, meets periodically, and recommends its findings, if any, to the RMC. In exercising its risk oversight, the Board receives periodic updates from the RMC concerning cybersecurity and other information security matters.

At Infosys, our employees operate in a hybrid model. Hence, we continue to remain vigilant about the evolving cybersecurity threat landscape and stay abreast of the latest evolving cybersecurity threats across the global landscape. Infosys is certified against the Information Security Management System (ISMS) Standard ISO 27001:2022. Additionally, we have been attested for SSAE 18 and ISAE 3402 SOC 1