Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 503

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 503
---
 ongoing basis to improve our internal and external cyber security environment. – Identify risk Our overall risk management process and evaluation scheme supports the assessment of cyber security risks. To ensure awareness and consistency in understanding cyber risk, IT relationship managers partner with the leaders of our businesses to identify critical enterprise systems and assets, completing business impact assessments as required. We assess the consequence should the confidentiality, integrity or availability of our information systems be breached. Our Threat Intelligence function maintains relationships with government, industry, professional bodies, and educational institutions, to ensure we remain aware and vigilant of the external threat landscape. Where threats are identified, this function will investigate our exposure (triggering an overall risk assessment where required), drive awareness and education to enhance vigilance and recommend control improvements. The Threat Intelligence function tests our vulnerability to key threats through penetration testing (ethical hacking) and simulating incidents such as the receipt of phishing emails. Finally, the function also consults with other IT and cyber functions to ensure we are designing our controls with knowledge of the latest threats. To identify new risks which may arise from technology changes, and from the evolution or ageing of technology environments, we maintain a dedicated capability in cyber risk analysis. This function conducts security risk assessments for IT projects and change requests, including for all third parties which impact our cyber security posture. They also deliver a program of risk-based deep-dive assessments of established technology environments to identify any emergent exposures. – Protect and control Cyber Security, in collaboration with IT operations, operates a suite of IT controls that protect our information systems through access control, change governance, back-up, and continuous vulnerability management. We use a variety of tools to continuously scan for, patch and monitor security vulnerabilities. To ensure an appropriate level of protection, we maintain a directory of control requirements and facilitate the development of technical standards. Management reporting on control performance, along with targeted compliance assessments, enables us to monitor our conformance to these standards. To operationalise the standards effectively, we maintain specialist capability across many security domains such as application, networks and secure operations. We maintain a persistent focus on developing the vigilance of employees and third-party users, which is essential for protection of information systems. Mandatory training is assigned to all relevant employees and contractors and is enhanced by a dedicated Cyber Security Awareness function. The cyber awareness training outlines user responsibilities in protecting Rio Tinto’s information assets, the acceptable use of information and electronic resources (including specific areas such as information classification and handling, appropriate internet use, email use and mobile device protection) and general awareness regarding specific cyber security threats.