Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 507

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 507
---
isation and auditing requirements; (iii) each user identity requiring access to Rio Tinto systems is linked to or owned by a uniquely identifiable individual; (iv) users, devices, and other assets are authenticated ( e.g., single-factor, multi- factor) commensurate with the risk of the transaction; (v) where access is required from outside the Rio Tinto network, multi- factor authentication must be used for client access; and (vi) information related to, or generated by, account management activities must be documented and retained for auditing purposes. 6) If remote access to any of our systems is required, third parties must ensure: (i) remote access is securely designed and managed; (ii) access is provided only to authorised parties for valid business reasons; (iii) access is revoked where no longer required; (iv) they will follow the required minimum technical controls to support the secure operation of remote access as specified by Rio Tinto; and (v) they will periodically review and monitor such remote access when no longer required. 7) Third parties must also do all things reasonably required to ensure our network integrity remains protected. To ensure our information is protected, third parties must ensure (where applicable) to: – Establish and maintain effective change control processes including: (i) determining the types of changes to the third parties' information system that are configuration-controlled, with explicit consideration for security impact analyses; (ii) documenting configuration change decisions associated with the third parties' information system; (iii) complying with Rio Tinto’s applicable change management processes; and (iv) retaining adequate records of configuration-controlled changes to the third parties' information system, to be provided to Rio Tinto on request. – Maintain response and recovery plans incorporating the following: (i) Disaster Recovery Plans (DRPs) for critical systems, incorporating essential service continuity, response and recovery requirements for these systems, and taking into consideration relevant cyber security threats and scenarios; (ii) DRP testing on a periodic basis to ensure procedures and controls are effective, and services restored are able to be restored within parameters. 8) Third parties must ensure appropriate encryption standards are applied to Rio Tinto information, including: (i) information classified by Rio Tinto as “Confidential” or “Highly Confidential” when stored on computer storage devices designed to be inserted and removed from a computer or system, including but not limited to optical discs and USB flash drives (removable media), or back-up media at off-site premises; and (ii) information exchanged