Company: VIST
Filing Date: 2025-04-09
Form Type: 20-F
Source: 0001193125-25-076856
Chunk: 114

Company: Vista Energy, S.A.B. de C.V.
Filing Date: 2025-04-09
Form: 20-F
Item: Item 16K
Chunk 114
---

ITEM 16K.   CYBERSECURITY
-------------------------
Risk Management and Strategy 
Our risk management framework includes regular assessments and updates to our cybersecurity policies, aligning them closely with industry best practices and emerging threats. We emphasize a proactive approach, integrating cybersecurity considerations into our strategic planning and operational processes. This ensures that potential risks are identified and mitigated before they can impact our operations. Additionally, our strategy is structured according to the categories of the NIST Cybersecurity Framework, providing a solid and standardized foundation for our cybersecurity practices.

188
Govern 

•   Cybersecurity processes are overseen by our Cybersecurity team, which reports to the Innovation and Technology Manager, who in turn reports to the CTO. The leader of our Cybersecurity team has over 12 years of experience in the field across various industries.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

•   The Cybersecurity team provides quarterly reports to the Cybersecurity Internal Committee, which oversees and sponsors the cybersecurity strategy. This committee has received fundamental cybersecurity training from a top-tier third-party consultant. Our CTO, who chairs the committee, provides quarterly updates to the Corporate Practices Committee of the Board of Directors.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

•   As part of our management process, the committee receives quarterly reports on the following key performance indicators:
----------------------------------------------------------------------------------------------------------------------------

•   NIST Maturity Score;
------------------------

•   Number of critical incidents that occurred during the period;
-----------------------------------------------------------------

•   Distribution of cybersecurity monitoring alerts within the period;
----------------------------------------------------------------------

•   Number of critical risk scenarios identified with a level 1 post-mitigation rating (highest impact and probability of occurrence);
--------------------------------------------------------------------------------------------------------------------------------------

•   Percentage of employees who completed mandatory cybersecurity training; and
-------------------------------------------------------------------------------

•   Average results of controlled phishing exercises.
-----------------------------------------------------

•   The Company’s cybersecurity and information security strategy is based on comprehensive risk assessment, mitigation, and resilience readiness. This is achieved through a threat intelligence-driven approach, application controls, and reinforced ransomware defense mechanisms. The framework follows several international standards, including NIST Special Publication 800-53 for general IT controls, ISA/IEC standards for industrial automation, the NIST Cybersecurity Framework for evaluating overall readiness, and SOX for assessing internal controls.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

•   We have implemented a Cybersecurity Policy and Standards, which serve as a comprehensive framework for our cybersecurity rules, technical standards, and procedures. This document is aligned with our corporate operating management system and establishes guidelines for developing, implementing, and enhancing procedures to protect information from unauthorized