Company: MT
Filing Date: 2025-03-10
Form Type: 20-F
Source: 0001243429-25-000017
Chunk: 52

Company: ArcelorMittal
Filing Date: 2025-03-10
Form: 20-F
Chunk 52
---
 data privacy (e.g., to increase protection and address breaches). Most Group entities undergo periodic security penetration testing exercises led by the Group CIO/ CISO team or external third parties throughout the year. Global Assurance as part of risk based approach also conducts penetration tests independently. The Company engages a wide range of third parties as part of the implementation and operationalization of its cybersecurity policies, cyber defense strategies and general cyber risk management, including specialist assessors, security consultants, IT auditors, forensic analysts, malware analysts and other third-party specialists. All third-party security providers that handle Company data or otherwise have access to ArcelorMittal’s network and systems are required to complete a rigorous risk assessment program in an online platform, which includes checks for data and cloud security, access, incident reporting and physical protection in accordance with the NIST CSF as well as applicable Company cybersecurity policies. In addition, Cyber Maturity Assessments are performed annually by an external consultant across many entities and segments for both IT and OT. Assessments are evidence-based exercises focusing on many key cyber processes, such as Vulnerability and Incident Management, Patching and Change Management, Malware Protection, Network Monitoring, Business Continuity and Disaster Recovery, and Software Security. Additionally, Global Assurance, as part of its risk based approach, performs cyber audits and penetration tests (as part of the annual plan). ArcelorMittal has been a long-standing customer of the BitSight rating service and has defined specific target levels and KPIs for cybersecurity in the BitSight platform. These risk measures are monitored daily and reported quarterly to the Data Protection Committee, led by the Group Data Protection Officer with representation from Group Compliance, Group HR and the Group CISO. BitSight also reports ArcelorMittal’s risk profile to Glass-Lewis for purposes of investor reporting. The office of the CISO has put in place an extensive online dashboard that tracks various metrics related to cybersecurity risks across various operating units. Such measures include: 1. BitSight External Cyber Ratings and Risk Factors 2. AntiMalware compliance levels

28

| Management report |

3. Active Directory security posture 4. Cloud Security cyber score and framework adoption 5. Ransomware Exploitable Vulnerability remediation status 6. Externally Facing Web Application Vulnerability levels 7. Cyber Awareness Education and Training 8. OS Level and Patching posture 9. Mobile security compliance 10. Security Baselines (IT and OT) quarterly assessments 11. Expired user account risk