Company: KARO
Filing Date: 2025-06-09
Form Type: 20-F
Source: 0001213900-25-052372
Chunk: 179

Company: Karooooo Ltd.
Filing Date: 2025-06-09
Form: 20-F
Item: Item 16K
Chunk 179
---
 information and technology for the Group and is composed of the Group Chief Operating
Officer (“ COO”), Group Chief Information Officer (“ CIO”), Group Chief Technology Officer (“ CTO”),
IT Governance and Risk Officer and other senior members of management as nominated by the Group Chief Executive Officer. The CIO has overall
responsibility for cybersecurity in the Group, including information security risk and compliance programs, as well as cyber resilience
and response plans. The CIO is supported by the IT Governance and Risk Officer and they work in partnership with various other senior
members of the business, including the COO, Group Chief Financial Officer, CTO, Legal Officer, Compliance Officer and the Data Protection
Officer to ensure that the Group’s information security posture is fit for purpose. Both the CIO and the IT Governance and Risk
officer hold degrees in Computer Science.

The CIO is supported by a global
team of experts who manage the day-to-day information and cybersecurity activities of the business. These staff hold certifications in
their various domains of expertise.

The IT Steering Committee presents
regular reports to the Audit and Risk Committee, which consist of a comprehensive governance report and dedicated risk register, including
ISO27001 risks, cybersecurity, information security and technology risks, management’s action plans to remediate material issues,
the mitigating controls that are in place, additional measures to be implemented, as well as anticipated residual risk levels. Significant
risks are extracted and included in the enterprise risk management dashboard. At the request of the Board, the external auditors review
the IT general controls as part of the annual audit.

The Board reviews and discusses the Group’s technology
strategy with the COO bi-annually.

Key procedures are:

  Cyber risk assessment;  

  Information security incident management, including incident  

  Cybersecurity incident notification schedule.  

At an operational level, the
Group has implemented technologies and systems architectures to ensure business resilience and we have adopted robust frameworks for managing
threat intelligence, performing vulnerability assessments and implementing appropriate technical and organizational measures to remediate
identified risks.

We use the information gained
through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response
infrastructure, including the actions to be taken in responding to and recovering from cybersecurity incidents, which include assessing
the severity of incidents, escalation protocols, containment of incidents, investigation of incidents and remediation.

Our aim is to address cybersecurity
risks by way of a cross-functional approach, focused on preserving the confidentiality, security and