Company: PAM
Filing Date: 2025-04-16
Form Type: 20-F
Source: 0001292814-25-001504
Chunk: 98

Company: Pampa Energy Inc.
Filing Date: 2025-04-16
Form: 20-F
Item: Item 16K
Chunk 98
---

Item 16K.   Cybersecurity.
--------------------------
Risk
 We maintain a comprehensive process (the “Cybersecurity Program”) for assessing, identifying, and managing potential cybersecurity threats, including risks that could affect our business operations.

 
The Cybersecurity Program is managed by our Information Security Manager (“CISO”) and overseen by our Chief Information Technology Director (“CIO”), who leads our information security team. This team is responsible for the development and execution of the Cybersecurity Program and is composed of individuals with formal education and degrees and certifications in information technology or cybersecurity and relevant experience working in information technology and cybersecurity, including related industries of the Company. Additionally, they receive periodic updates, training, and education on cybersecurity related topics.

 
As part of our Cybersecurity Program, the information security team carries out the following activities:

 

181
---

Table of Contents
-----------------

·                                                Coordinates the actions that we execute to detect,                                            
       respond to and recover from cybersecurity incidents, such as processes to triage, assess severity for, escalate, contain, investigate   
    and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damages.
-----------------------------------------------------------------------------------------------------------------------------------------------

·                          Uses the National Institute of Standards and                       
    Technology (NIST) Cybersecurity Framework to measure our security posture and manage risk.
----------------------------------------------------------------------------------------------

·                                                     Monitors, detects and prevents cybersecurity                                                  
    threats through different software and hardware solutions to protect our environment, such as multifactor authentication, firewalls, penetration
                                                 testing, and a 24/7 Security Operation Center (“SOC”).                                             
----------------------------------------------------------------------------------------------------------------------------------------------------

·                                                Conducts annual cybersecurity trainings for all                                              
    our employees with the aim of deepening awareness and learning regarding risks, threats, and good practices in information security, where
      different interactive initiatives are performed. During the year 2024, we carried out these trainings for the eighth consecutive year.  
----------------------------------------------------------------------------------------------------------------------------------------------

·            Completes regular tests of our controls through          
    penetration testing, vulnerability scanning and attack simulation.
----------------------------------------------------------------------

·                                              Informs the CISO, through e-mails and automated                                           
    security alerts, of any cybersecurity matter. At least weekly, the CISO informs the CIO the relevant events during the period, having
                                          special meeting or communications if urgent matters arise.                                     
-----------------------------------------------------------------------------------------------------------------------------------------
 

Moreover, our Board recognizes the importance of cybersecurity in safeguarding the Company’s sensitive information and the potential effects that a cybersecurity incident could have on our operations. The Board