Company: VIST
Filing Date: 2025-04-09
Form Type: 20-F
Source: 0001193125-25-076856
Chunk: 115

Company: Vista Energy, S.A.B. de C.V.
Filing Date: 2025-04-09
Form: 20-F
Item: Item 16K
Chunk 115
---
 access and misuse, ensure the availability of critical systems, and maintain data protection and integrity. This policy is the cornerstone of our information security management system and an integral part of our cybersecurity governance framework.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Identify 

•   We maintain a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats, including risks related to business operations disruption, financial reporting systems, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws, litigation and legal risks, and reputational risks.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

•   Risk assessments are conducted on an ongoing basis. The likelihood and impact of each risk are determined using a qualitative risk assessment methodology. Risks are identified from various sources, including vulnerability scans and penetration tests. We monitor our infrastructure and applications to detect evolving cyber threats and possible intrusions. The assessment results are reported quarterly to Company management through our cybersecurity risk matrix in accordance with the established cybersecurity governance model.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

189
    
•   Third-party risk management is integral to our approach, involving rigorous due diligence and continuous monitoring of our vendors and partners to ensure alignment with our cybersecurity standards.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Protect 

•   This function is built on advanced security technologies and is managed by a team of experts with significant experience in cybersecurity best practices.
-------------------------------------------------------------------------------------------------------------------------------------------------------------

•   The Company employs comprehensive policies, software, training programs, and hardware solutions to safeguard and monitor its environment. These measures include multifactor authentication for all critical systems, firewalls, intrusion detection and prevention systems, and vulnerability and identity management systems.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

•   Our platform incorporates a suite of technologies, including encryption, antivirus, multi-factor authentication, firewalls, and patch management. These technologies are designed to protect and maintain the integrity of systems and computers across our organization.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

•   Our Cybersecurity team regularly tests security controls through penetration testing, vulnerability scanning, and attack simulation activities.
---------------------------------------------------------------------------------------------------------------------------------------------------

•   The Cybersecurity team conducts annual information security awareness training for all employees, performs internal phishing tests, provides targeted training for employees who click on phishing attempts, mandates security training for new hires, and publishes cybersecurity newsletters to address emerging or urgent security threats.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Detect and Respond 

•   We have a Cybersecurity Incident Response Plan that outlines the procedures for handling cybersecurity incidents based on their severity and ensures cross-functional coordination. Additionally, we have established a Cybersecurity Detection and Response team to