Company: CTTRF
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001292814-25-001765
Chunk: 284

Company: Controladora Vuela Compania de Aviacion, S.A.B. de C.V.
Filing Date: 2025-04-30
Form: 20-F
Item: Item 16J
Chunk 284
---
ITEM 16J INSIDER TRADING POLICIES

We have adoptedan insider trading policy that governs the purchase, sale, and/or other dispositions of our securities by directors of the Company
and the Covered Persons (as defined in the policy) that is reasonably designed to promote compliance with Mexican and US insider
trading laws, rules and regulations, and the listing requirements of the Mexican Stock Exchange and New York Stock Exchange. A copy
of our insider trading policy is attached as Exhibit 11.1 to this annual report.

ITEM 16KCYBERSECURITY

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management
program aimed at safeguarding the confidentiality, integrity, and availability of our critical systems and information.

Our approach to cybersecurity is based on the National Institute
of Standards and Technology Cybersecurity Framework (NIST CSF) and the International Organization for Standardization 27005 (ISO/IEC 27005:2022).
It is important to note that while we reference these frameworks, that does not imply strict adherence to specific technical standards,
specifications, or requirements. Instead, we use the NIST CSF and ISO 27005:2022 as guiding principles to identify, assess, and manage
cybersecurity risks relevant to our business.

Moreover, our cybersecurity risk management program integrates
into our broader enterprise risk management framework through shared methodologies, reporting channels and governance processes.

With our cybersecurity risk management program, several key
components include the following:

Risk assessments: Assessments are conducted to identify and prioritize significant cybersecurity risks to our critical systems and
Dedicated security team: A specialized security team oversees the risk assessment processes, manages security controls, and orchestrates
Utilization of external service providers: We engage external service providers as we deem appropriate to help augment our capabilities,
Cybersecurity awareness training: Through training initiatives, we seek to empower our employees and incident response personnel with
Cybersecurity Incident Response Plan: Our response plan outlines processes for addressing cybersecurity incidents, minimizing disruptions
Third-Party Risk: We seek to assess risk and to obtain cybersecurity-related contractual commitments from critical service providers

For the Company, cybersecurity risk management is
not merely a compliance exercise but viewed as important to our operational ethos. As technology evolves and threats evolve with it, we
remain committed to working to enhance the security and resiliency of our organization. We have not identified risks from known cybersecurity
threats, including as a result of any prior cybersecurity incidents, thathave