Company: PBR
Filing Date: 2025-04-03
Form Type: 20-F
Source: 0001292814-25-001352
Chunk: 45

Company: PETROBRAS - PETROLEO BRASILEIRO SA
Filing Date: 2025-04-03
Form: 20-F
Item: Item 17
Chunk 45
---
 enhance security, privacy, and technological capabilities.

 To reinforce our security measures, we:

  

–                                            engage                                         
    independent companies for periodic vulnerability identification and penetration testing.
--------------------------------------------------------------------------------------------

–                                              conduct                                           
    regular information security reviews based on the NIST Cybersecurity Framework by third-party
                                              auditors.                                          
-------------------------------------------------------------------------------------------------
 
We have been enhancing our operational cybersecurity maturity by implementing a robust strategy to safeguard industrial automation and control systems. This includes adopting advanced monitoring tools, strengthening defense in-depth measures, conducting regular vulnerability assessments, simulating industrial cybersecurity incidents and monitoring key performance indicators. These efforts aim to leverage the resilience of critical operations by mitigating cyber risks in an increasingly connected industrial environment.

 
Risk Management and Digital Controls

 We regularly assess and manage risks related to cybersecurity in both corporate and industrial automation and control system environments.

 These risks are incorporated into our corporate risk matrix and monitored by senior management.

 Our risk management process involves:

  

–           identifying         
    threats and vulnerabilities.
--------------------------------

–              implementing          
    controls and mitigating measures.
-------------------------------------

–                        assessing                      
    likelihood and impact using qualitative methodology.
--------------------------------------------------------
 
We extend our cybersecurity risk management to third-party service providers by:

  

–                        establishing                    
    cybersecurity requirements for business transactions.
---------------------------------------------------------

–                           contractually                         
    obligating vendors to maintain strict cybersecurity standards.
------------------------------------------------------------------
 
Currently, we do not maintain cybersecurity incident insurance due to market conditions, but we regularly evaluate available options.

 Our business strategy, operations, and financial condition have not been materially affected by cybersecurity threats or previous incidents, but we cannot provide assurance that we will not be materially affected in the future by such risks and any future material incidents.

  
Annual Report and Form 20-F 2024 |

In the past three fiscal years:

  

–                          no                       
    material information security breaches occurred.
----------------------------------------------------

–                         expenses                      
    from information security incidents were immaterial.
--------------------------------------------------------

–                      no                  
    penalties or settlements were incurred.
-------------------------------------------
Digital Continuity Program

 To ensure our ability to withstand a cyberattack scenario, we have established a comprehensive Digital Continuity Plan. This plan aims to guarantee the uninterrupted functioning of critical processes in the event of a crisis or digital disaster. We have implemented contingency measures for critical digital assets, documented recovery procedures for these assets, and regularly test the effectiveness of our plans.

 In managing serious incidents, we follow the Incident Command System, a corporate crisis handling methodology. This methodology is also applied in our cybersecurity practices, ensuring a structured and coordinated response to any significant incident.