Company: BIP-PB
Filing Date: 2025-03-24
Form Type: 20-F
Source: 0001628280-25-014380
Chunk: 486

Company: Brookfield Infrastructure Partners L.P.
Filing Date: 2025-03-24
Form: 20-F
Item: Item 16K
Chunk 486
---
ITEM 16K. CYBERSECURITY

Risk management and strategy

We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats.

We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute of Standards and Technology Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.

In addition, all employees regularly undergo mandatory continuing cybersecurity and data protection training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. We continue to focus on readying our assets by implementing a standard way to test the systems of our portfolio companies annually through cyber readiness drills. These drills consist of simulations of potential threats in which companies need to detect, protect against, and recover from an attack. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The policies, standards, and guidance are structured to help our company respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. The Chief Information Officer (“ CISO”) appointed by BN’s executive management pursuant to the EISP is responsible for modifying our group’s policies, standards, and guidance as needed to adjust to this changing environment.

The effectiveness of these programs is evaluated regularly through both internal and third-party audits.

In 2023, we undertook the following initiatives: further enhanced our data protection and threat-intelligence capabilities; improved our processes for third-party risk management; continued mandatory cybersecurity education for all employees; and incorporated social engineering to our phishing simulations. When weengage third parties, we have policies and processes to govern their access and reduce the risks associated with their access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.

Data privacy and cybersecurity are one element of our comprehensive approach to strong corporate governance and risk management practices, which also focuses on corporate governance ethics; our board of directors; ethical business conduct; supply chain and vendor management; and human rights and modern slavery