Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 506

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 506
---
 magnitude of operational disruption exposures. As a result, we are initiating a program to simplify cyber security governance and improve the integrity, consistency and monitoring of key cyber security controls. We will focus on uplifting the skill and capability of IT relationship managers and owners of IT risk, with the goal of improving cross- functional collaboration in assessing local exposures to cyber security risk, and enhancing the breadth and depth of cyber security business impacts assessments. We are also investing in strengthening our core cyber security capabilities such as our Threat Intelligence function to ensure we remain aware and vigilant of the threat landscape. – Third party cyber security requirements Each component of our cyber security risk management framework considers the role of third parties we engage , and supports adaptation of our controls for all third party relationships. For each third party working with us or managing our systems and data, cyber security is considered within the process of on-boarding and managing the relationship. Some of the specific requirements we make publicly available for any third parties who engage with us are outlined below. Third parties must ensure their information technology and other business systems meet the following general requirements when providing products or services to the Group, or otherwise interfacing with Rio Tinto’s enterprise and industrial and operational technology systems: 1) Any technology systems used or services provided by the third party must not expose Rio Tinto to material cyber security risk. 2) An appropriate cyber security risk assessment has been conducted on relevant own and any third party systems in particular: identifying key technical, and compliance measures required to ensure the confidentiality, integrity and availability of information is maintained; and ensuring that control measures applied are commensurate with assessed risk. The results of any risk assessment will be made available to us on request. 3) Key technology systems have response and recovery plans, with recovery plan testing being undertaken periodically to ensure procedures and controls are effective and services are able to be restored as soon as possible. 4) On termination of the relationship with us, third parties must ensure the return, or the destruction, of Rio Tinto information being held; any access to the Rio Tinto environment is terminated; and any Rio Tinto intellectual property is appropriately transitioned back to Rio Tinto.

| Annual Report on Form 20-F 2024 | 339 | riotinto.com |

Additional information | US Disclosure 5) If access is required to any Rio Tinto information technology or business systems, the third party must ensure: (i) access must be appropriately restricted to only the personnel requiring access; (ii) access procedures must cover identification, authentication, author