Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 505

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 505
---
, and to trigger the critical incident management process as required. Throughout the response, we maintain incident records which include an assessment of the scale of potential and verified impacts. Impact thresholds trigger disclosures to governance bodies including the CSSC, Chief Legal Officer and the Disclosure Committee. This response function is regularly exercised to test the speed and effectiveness of response. Internal processes and agreements with our partners enable us to scale the function rapidly in the case of major events. Our incident response function also has defined points of integration with other functions such as business resilience, corporate communication and networks. Cyber Security leverages a combination of tools for detecting and responding to incidents across all our operations. These include, but are not limited to, endpoint detection and response, network, identity and access management, email, cloud platform, and industrial and operational technology monitoring tools. For incidents not detected and responded to through automated means, Cyber Security uses a security information and event management solution (Microsoft Sentinel) for log aggregation and analysis, with specific rules configured to alert on anomalous or suspicious behaviour. Incidents are managed and tracked in Jira, which integrates with the Microsoft Security stack. The tooling is supported by a number of people and process- related controls that ensure incidents are identified in an accurate and timely manner. – Recover Recovery plans in place for critical applications cover the steps and actions required to restore services in the case of a cyber security incident. In addition to information system recovery plans, our overall Business Resilience and Recovery Program may trigger the formation of business resilience teams to execute business continuity and recovery plans, as well as handling crisis communications, governance and disclosures. The business resilience management plan for our IT function is tested annually. To ensure the readiness and effectiveness of recovery plans, we run training programs for all accountable persons and involve them in simulated events that are run to test and improve response capability. For any simulation or actual event, a debrief occurs to capture lessons learnt. These are then shared and reported on to ensure the lessons drive continuous improvement of our recovery processes. – Assure and improve Our cyber security risk management process includes ongoing inspection and assurance to test the cyber security of our environment and of our third parties, which is key to addressing weaknesses before they are exploited. In 2024, neither Rio Tinto nor any third parties who operate our IT systems and processes, were exposed to cyber security threats or any risk which will or may be reasonably likely to materially affect our strategy, performance or financial position. However, the growing reliance on technology to underpin productivity is increasing the breadth and