Company: PLSAY
Filing Date: 2025-05-09
Form Type: 20-F
Source: 0001884082-25-000012
Chunk: 304

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-05-09
Form: 20-F
Item: Item 16K
Chunk 304
---
 Committee”), which oversees the Company’s risk management function. TheChief Information Security Officer/Chief Security Officer (“ CISO/CSO”)reports to the Committee at least twice a year through the Company’s enterprise risk management process to provide updates on the company’s cybersecurity risks, cybersecurity risk management, cyber incident response and developments within the security areas.

Management Role

As of April 1, 2025, we have strengthened our security through the formation of a new unified security organization, where Information- and IT-security, Product Cyber Security and Corporate Security is now under one cohesive structure under the leadership of a newly appointed CISO/CSO. Through this change we will further strengthen our security by reducing silos, strengthening oversight, enhancing collaboration, gaining synergies and improving cost efficiency.

The CISO/CSO has the overall responsibility for the Company´s security landscape, including cyber security risk management and overseeing the information security, product cyber security and corporate security teams. Our CISO/CSO is a thought leader within the security domains with experience from senior management positions covering both public and private sectors, small to large enterprises. Previous roles include CSO positions within the aviation industry, CISO positions within the energy sector as well as former position as CISO for an organization within the automotive industry.

As a part of their duties, members of management regularly work to address the cybersecurity risks that Polestar faces in its daily operation and actively work to prevent and remediate cybersecurity risks and incidents by remaining appraised of active cybersecurity risks identified by security teams. Additionally, the CISO/CSO informs members of management of active cyber security threats identified by third-party and governmental agencies. The CISO/CSO also annually meets with management regarding the evolution of the cybersecurity function.

The SOC and security teams escalate cybersecurity events to the CISO/CSO and members of senior management and the Committee according to the severity of the cybersecurity incident. For more serious incidents, the CISO/CSO will trigger the crisis management plan, which convenes the Crisis Management Team. The CISO/CSO will also inform the Enterprise Management Team to provide them with details about the cybersecurity incident and the plan to mitigate risks.

PART III