Company: MT
Filing Date: 2025-03-10
Form Type: 20-F
Source: 0001243429-25-000017
Chunk: 51

Company: ArcelorMittal
Filing Date: 2025-03-10
Form: 20-F
Chunk 51
---
 in cyber security, digital transformation, IT integration and business enablement . He joined ArcelorMittal in 2024 from a leading transportation / logistics company where he served as their IT senior vice president and international CIO from 2017 . He holds an MBA in international management from the Thunderbird School of Global Management, Glendale , Arizona, USA, and a Bachelor of Engineering in electronics and communication from the National Institute of Technology, Trichy, India. On a quarterly basis, the Group CISO provides a cybersecurity risk report to the Group Finance Risk Committee, headed by the Group CFO, based on risks identified at the segment level, which in turn reports to and assists the Board of Directors in fulfilling its oversight responsibilities with respect to legal and regulatory requirements, including cybersecurity. Risks identified in the report are considered potential risks that may affect all functions and departments across the Group. The office of the CISO has identified the following four key risk areas: 1. Large-scale cyber-attacks or malware causing economic damage and/or reputational harm to ArcelorMittal. 2. Dependency risks and increased vulnerability to outages of critical systems (applications or infrastructure) causing significant disruption to ArcelorMittal. 3. Adverse consequences of technological advances such as Artificial Intelligence (“AI”), cloud-based programs or systems, Internet of Things (“IoT”) and Blockchain, which may cause harm to ArcelorMittal. 4. Wrongful exploitation of personal information causing regulatory liabilities (e.g., GDPR or similar laws) or of business data causing contractual or other legal liabilities (e.g., relating to IP, R&D or customers) that would have significant negative impacts on ArcelorMittal. As part of the risk management process, the Group’s local IT teams, segment CIOs and segment CISOs also identify local cyber risks and report to the Group Finance Risk Committee. The office of the CISO defines policies and procedures related to cyber and information security as well as to permissible and secure uses of cloud, operational technology (“OT”) and IoT within the Company. ArcelorMittal follows the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Group’s cybersecurity policies focus on protecting information systems against disclosure to unauthorized users (confidentiality), improper modification (integrity) and non- access when required (availability). These polices are implemented across the Group and tracked and reported on a quarterly basis. Additionally, the Company has in place a global incident and crisis process with special procedures for ransomware and