Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 504

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 504
---
 Role-based security training is also provided to key system support personnel with assigned privileged roles and responsibilities. The training must be completed before they are authorised to access the information system, perform assigned duties, or when key changes have been made to the information system. All employees and contractors are required to formally acknowledge their understanding and acceptance of the training upon completion. Our Cyber Security Awareness function also provides communications, events, on-demand materials and presentations, and a suite of cyber safety shares integrated into Health, Safety, Environment and Security processes. In recognition of the role all employees play in the cyber security risk management process, clear expectations for data privacy, cyber security, and handling of confidential information are set out in The Way We Work . These state that all employees must: i) understand that cyber security is also their responsibility and what they do with electronic devices can weaken or strengthen Rio Tinto’s cyber security; ii) adhere to our Acceptable Use of Information and Electronic Resources Standard ; iii) complete the mandatory cyber awareness training; iv) remain vigilant and report anything suspicious to the Cyber Security team; and v) never consciously try to bypass any cyber security control.

| Annual Report on Form 20-F 2024 | 338 | riotinto.com |

Additional information | US Disclosure To extend protection to third parties, we conduct security risk assessments upon engaging a third party. We also share our policies and expectations with third parties, and apply standard clauses within contractual agreements, enabling a program of risk-based compliance assessments to be conducted across the third parties we engage. – Detect events We persistently monitor network traffic and system logs through our monitoring function. This includes automated alerting of anomalous events, and the triage and response initiation for these. A key capability of the function is to continuously test, refine and optimise our monitoring and alerting framework which we do by simulating cyber events and leveraging industry datasets and knowledge. In addition to technical monitoring, we maintain reporting and communication channels, allowing all users and third parties to report any anomalies or incidents they observe. This includes anonymous reporting via our whistle- blower processes. For situations where the first indicator of an event may be a system issue or outage, our Critical Incident Management and Cyber Incident Response functions have established ways of working to ensure the earliest detection of any cyber security events. – Respond For identified cyber security events, the 24-7 Cyber Incident Response function will take action to contain, analyse and remediate. A defined triage process guides the assessment of the impact to determine the level and urgency of the response required