Company: BBU
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001628280-25-017216
Chunk: 436

Company: Brookfield Business Partners L.P.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 16K
Chunk 436
---
ITEM 16K. CYBERSECURITY

Risk management and strategy

We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the Enterprise Information Security Policy (“ EISP”) established by Brookfield.

We believe our cybersecurity program is reasonably designed to materially protect the security of both our company’s data and the data in our custody. Our policies and procedures address security governance, security awareness and training, access management, vulnerability management, penetration testing, security monitoring and incident response. We use automated technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute Standards of Technology cybersecurity framework in meeting and exceeding the industry average in cybersecurity practice.

In addition, all employees involved in activities with our company and our operating companies regularly undergo mandatory continuing cybersecurity and data protection training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The policies, standards, and guidance are structured to help our company respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. Our company modifies its policies, standards, and guidance as needed to adjust to this changing environment.

Our cybersecurity program is one pillar of our larger corporate governance framework and approach to risk management, which also encompasses oversight by the BBU General Partner’s board of directors and board committees, our Code of Business Conduct and Ethics, our Anti-Bribery and Corruption Policy and our Ethics Hotline.

We also engage regularly with third-party assessors to evaluate the strength of our program through penetration and/or ethical hacking exercises. We have policies and processes to govern third-party access and reduce the risks associated with such access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.

  232      Brookfield Business Partners  

Despite the security measures implemented as part of our cybersecurity program, the current cyber threat environment presents increased risks for all companies. In the fiscal year ended December 31, 2024, we were the target of cyber-attacks.

We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have