Company: AKO-B
Filing Date: 2025-03-26
Form Type: 20-F
Source: 0001410578-25-000473
Chunk: 172

Company: ANDINA BOTTLING CO INC
Filing Date: 2025-03-26
Form: 20-F
Item: Item 16K
Chunk 172
---
ITEM 16K. CYBERSECURITY
Coca-Cola Andina recognizes information security and cyber-attacks as potential areas of business risk. Consequently, the Company has formulated and implemented a comprehensive strategy that enables us to safeguard confidentiality, integrity and availability of information and critical data and systems by (i) establish an organizational understanding for the purpose of overseeing cybersecurity risks related to its systems, people, assets, data and capabilities, (ii) safeguard systems and assets (including data), (iii) identify deviations from established protocols, (iv) react to cybersecurity incidents, and (v) restore business operations, if required.

105

Governance
Our cybersecurity risk management program is supported by a compliance scheme based on a framework of supervisory and governance entities. This includes the Audit Committee, which is represented by 3 independent directors, our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Audit Officer. One of the Audit Committee’s responsibilities is to supervise the policies, guidelines and strategies for information security risk management in order to ensure compliance with national and international standards, evaluating for this purpose the scope and effectiveness of information security systems, the status of cybersecurity framework controls within the organization, ongoing initiatives and future work plans. We conduct ongoing internal cybersecurity audits that are reported directly to the Audit Committee as well as The Coca-Cola Company, where our security maturity and status is also assessed. 
Additionally, to protect against and address cybersecurity incident management and decision-making, there is a senior management committee known as the “Cybersecurity Committee” which is led by the Chief Information Security Officer (CISO). This cross-functional management committee drives awareness, ownership and alignment across broad stakeholder groups on governance and risk for effective management of cybersecurity risks and when a threat affecting the security of our digital information assets materializes, or at least once a year, the Cybersecurity Committee meets, both to manage the crisis and/or evaluate and control cybersecurity risks, to approve the cybersecurity strategy and direction and the organization’s contingency processes, and to perform a general evaluation of the different cybersecurity risk management indicators. 
The Cybersecurity Committee is comprised of the Company’s CISO, the Company’s Chief Human Resources Officer, Chief Legal Officer, Chief Information Technology Officer, the Company’s Risk and Sustainability Corporate Manager, and a Representative of the Corporate Internal Audit Area. The Company’s CISO is responsible for overseeing and managing cybersecurity issues and risks. This includes being responsible for creating, managing, and carrying out the company’s cybersecurity plan for its networks, both IT (information technology) and OT (oper