Company: SQM
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0000909037-25-000020
Chunk: 216

Company: CHEMICAL & MINING CO OF CHILE INC
Filing Date: 2025-04-24
Form: 20-F
Item: Item 16K
Chunk 216
---
ITEM 16K.   CYBERSECURITY
Policies and Procedure
The purpose of information security and cybersecurity is to define the general guidelines regarding the Information Security Governance and Management System (SGGSI) and which must be known, adopted and complied with by all employees of the company, as well as third parties linked to it. SQM defines that the effective Governance and Management of Information and Operation Technology Security (IT/OT) is a business function and as such a critical element for the success and survival of SQM in a globalized and highly competitive world. 
An information security strategy is developed and implemented in alliance with business strategies, information technologies (IT) and operational technologies (OT). The scope and extent of the information security strategy depends on the size, complexity of the company, its business activities, risks, vulnerabilities and threats, providing a reasonable defense against any internal or external attack. This cybersecurity strategy addresses preventive, detective, corrective and reactive measures. Also, an important aspect is the information security incident management life cycle, which consists of being able to methodologically analyze Information Security & Cybersecurity (ISC) events/incidents from a point of view of the impact they could cause to the company. Incident response methodologies generally emphasize preparedness, not only establishing an incident response capability, but also preventing incidents by ensuring that systems, networks and applications are sufficiently secure. Preparation involves implementing the appropriate tools and configuring appropriate processes and procedures for treatment before an incident occurs. One of the most important tasks is to identify the assets that must be protected.
We have incorporated cybersecurity related risks into our overall risk management system, which is built considering international standards, such as ISO 31000 and COSO ERM (Committee of Sponsoring Organizations Enterprise Risk Management), and includes the following stages:
Risk Identification: To identify the risks, meetings will be held between the business risk management area and the different process owners of each business unit or business areas, who, due to their responsibilities, can be presumed to understand significant risk situations.
Based on this input, the Business Risk Management Department will prepare a list of the risks identified for each unit. This list will be called a "risk inventory".
Risk Analysis: Risk analysis includes the study of the causes and consequences in the event of a risk materialization. A risk can have multiple causes and consequences, which can affect more than one risk, so its correct identification will provide an in-depth analysis of the risk and its possible consequences. For any critical risk related to our strategic objectives, such as the risk of cybersecurity,