Company: AKO-B
Filing Date: 2025-03-26
Form Type: 20-F
Source: 0001410578-25-000473
Chunk: 174

Company: ANDINA BOTTLING CO INC
Filing Date: 2025-03-26
Form: 20-F
Item: Item 16K
Chunk 174
---
 the largest technology companies in Latin America. This company provides us with field support, users support center, networking support and cyber security monitoring. The IT outsourcing service is governed by a contractual agreement that specifies service levels and a Data Processing Agreement. An external auditor conducts an annual audit of the services to assess the adherence of the controls of the critical services rendered via ISAE 3402. All technology suppliers that offer on-premise SaaS or software are assessed throughout the selection procedure using an INCIBE-CERT-based cyber resilience framework (National Cybersecurity Institute of Spain).
Cybersecurity Framework
Our cybersecurity risk management program was developed in accordance with, and aligned to, international standards, best practices, and worldwide frameworks such as the International Organization for Standardizations (ISO) and the National Institute of Standards and Technology Cyber Security Framework (NIST) and incorporates the highest industry standards and is continually tested for Business Continuity (BC) and Disaster Recovery (DR). Our program is managed with an integrated people, processes, and technology vision and in order to improve its cyber resilience, the Company has a cybersecurity strategy to which it adds new controls and systems every year. This involves a risk management methodology based on a Business Impact Analysis (BIA) and Risk Impact Analysis Information Technology (RIA IT) model to unify risk and processes deemed critical to the organization, as well as regular and comprehensive testing of vulnerability mitigation measures found through ethical hacking, pentesting and vulnerabilities assessments. This activity gives a clear picture of known vulnerabilities in the system so that they can be specifically fixed and additional searches for undiscovered weaknesses, foreseeing future attacks and strengthening defenses. Furthermore, a “Zero Trust” model for platform access, Privileged Access Control and Multifactor Authenticator has been implemented for all platforms and user access. We use policies, processes, software, training programs, and hardware solutions to protect and monitor our environment across all critical systems, firewalls, intrusion detection and prevention systems, anti-malware, patch management, and identity management systems.Corporate Cybersecurity Policy
The Company’s Corporate Cybersecurity strategy provides a framework for effective security management processes pertaining to IT systems and the associated assets, and it establishes a control model for the protection of the confidentiality, integrity, and availability of information systems, in accordance with the applicable laws and regulations in the countries in which we operate. Our cybersecurity risk management program also includes review and assessment by independent, external third parties, who evaluate and report on our cybersecurity program, as well as preparedness for internal incident response and help identify areas for continuous