Company: FRHC
Filing Date: 2025-06-13
Form Type: 10-K
Source: 0000924805-25-000012
Chunk: 149

Company: Freedom Holding Corp.
Filing Date: 2025-06-13
Form: 10-K
Item: Item 1C
Chunk 149
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our technology strategy. Our overall cybersecurity risk management covers IT, information security and data protection risk and its objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards (such as ISO, NIST, CIS, FAIR and others), threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Some of our subsidiaries are certified under ISO 27001, an international information security management systems standard, or undergo regular Payment Card Industry Data Security Standard (PCI) audits. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate technology risk, including our corporate IT control system, to work towards a consistent minimal level of cybersecurity across all our subsidiaries. We engage in periodic or regular monitoring and assessments of our technology key infrastructure and processes using internal staff and third-party specialists utilizing methods such as penetration testing, vulnerability scanning, code, configuration reviews. risk and security assessments. We assess and manage risks, including IT and cybersecurity risks, associated with external service providers and our supply chain, utilizing methods such as security assessments, SLAs, information security and data protection contractual clauses. Our audit procedures include testing of IT and cybersecurity controls to ensure reliability. The type, maturity, and formalization of controls in our subsidiaries is informed by the level of anticipated threats and their impacts associated with each organization.We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with a material or reasonably likely material impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization.

57