Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 219

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 16K
Chunk 219
---
 enterprise risks monitored by the ERM and periodic updates on the risks and mitigations are provided as per the governance structure guidelines.

Infosys Cyber Risk Management (CRM) is a comprehensive program designed to identify, analyze, prioritize, treat, and monitor cyber risks and vulnerabilities across the enterprise. Our cyber risk assessment framework aligns with ISO 31000, ISO 27001, and ISO 27005 standards, in a manner designed to ensure a robust and standardized approach. Our CRM processes are seamlessly integrated with Infosys’s Enterprise Risk Management (ERM) framework, promoting consistency and thoroughness throughout the risk management lifecycle. This integration facilitates cross-functional risk analysis and streamlined reporting to the management. Infosys’s CRM focuses on safeguarding information, information processing assets, and facilities of Infosys and all its subsidiaries, thereby ensuring the continuity of our business operations. Our vulnerability management program is built on a remediation strategy that emphasizes threat-based prioritization, vulnerability aging analysis, and continuous tracking. Additionally, Infosys’s third-party security risk management program is designed to effectively manage potential security risks and vulnerabilities at every stage of supplier engagement. This program incorporates strong governance processes, continuous monitoring of security metrics, threat intelligence tracking, and periodic risk assessments.

Multiple committees and sub-councils, ranging from the board level to the departmental functional level, have been established to ensure focused governance and continuous monitoring of cyber risks across all levels of the organization.

Due to the constantly evolving and increasingly complex nature of cybersecurity risks, timely detection and defense are crucial to bolster our internal risk management processes. In this regard, Infosys collaborates periodically with third-party security consultants. These engagements include cybersecurity maturity assessments, gap analysis, evaluations of security controls and processes, and table-top exercises. These experts, who are well-versed in the latest cyber trends and threat landscapes, provide valuable recommendations and guidance to address and mitigate risks. Observations from these engagements are reviewed with the senior management to determine appropriate actions to address any identified findings.

Governance

Infosys’s cybersecurity program is managed by a dedicated team of seasoned professionals who constitute the Information Security Group (ISG). This program employs a multi-layered defense-in-depth approach, starting with a robust cybersecurity strategy, supported by comprehensive policies, processes, and controls (preventive,

detective, and corrective).

Infosys Management plays a vital role in managing material risks from cybersecurity threats. A full time Chief Information Security Officer (CISO) has the overall responsibility for the Infosys cybersecurity program. From driving thought leadership and security culture to enabling enterprise security