Company: SUZ
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001628280-25-020368
Chunk: 43

Company: Suzano S.A.
Filing Date: 2025-04-28
Form: 20-F
Item: Item 16
Chunk 43
---
 and manage risks arising from vulnerabilities, including risks related to disruptions to business operations or financial reporting systems, intellectual property theft, fraud, extortion, harm to employees or customers, privacy law violations, and other legal disputes and risks, as part of our overall risk management system and processes.
Our information security and cybersecurity risk management processes include the following:
•Our processes are structured based on NIST Cybersecurity and ISO 27001 frameworks. Our processes and policies are periodically reviewed to cover relevant risks.
•We utilize components in our information security and cybersecurity framework such as multi-factor authentication, firewalls, antivirus software, vulnerability and penetration testing, among others.
Table of Contents

•Additionally, we collaborate with other areas of the Company, encompassing those responsible for day-to-day Information Security and Cybersecurity matters, including our Cybersecurity team, Legal, Audit, Human Resources, and Corporate.
•We frequently conduct training and awareness campaigns on information security and cybersecurity so that everyone receives guidance and can identify and report information security events or incidents, both in the corporate and industrial environments. These actions are intended to promote familiarity with our Information Security Policy. We also leverage internal communications to raise awareness and conduct phishing simulation exercises.
•We regularly review, test, and update our information security and cybersecurity processes by conducting penetration testing, vulnerability assessments, and attack simulations. Measures are implemented to deter, prevent, detect, and respond to unauthorized activities in our systems.
We annually conduct assessments of cybersecurity controls through independent consulting firms, which contribute to the evolution of the maturity on the subject. The results of these assessments are shared with the executive leadership, and relevant points are addressed throughout the year.
Our information security risk management aims to identify, analyze, evaluate, and treat all of our information security risks, as a continuous and measurable process. Relevant information security risks are treated so that they are mitigated, avoided, or accepted. When mitigating, we seek to reduce the likelihood of damage to our assets and business impact whenever possible. Information security risks are periodically reported to the Cybersecurity Management, for the responsible Head, and the Company’s Senior Management. Furthermore, relevant information security incidents are also reported to the same responsible parties and, when applicable, to the Competent Authorities within the established deadline.
Our business strategy, operational results, and financial situation have not been materially affected by information security risk or incident, including previous information security incidents. We cannot provide assurance that they will not be affected in the future by such risks and any future incidents.
Governance
Head of Technology 
The Head of Technology