Company: MT
Filing Date: 2025-03-10
Form Type: 20-F
Source: 0001243429-25-000017
Chunk: 53

Company: ArcelorMittal
Filing Date: 2025-03-10
Form: 20-F
Chunk 53
---
 12. Cyber attack simulation effectiveness Cybersecurity Related Events in 2024 In 2024, ArcelorMittal did not experience any cyber-attacks, cybersecurity threats or other information security incidents that materially affected or were reasonably likely to materially affect the Company’s business strategy, results of operations or financial condition. See "Risk factors and control— ArcelorMittal’s reputation and business could be materially harmed as a result of data breaches, data theft, unauthorized access or successful hacking”. Governance ArcelorMittal has implemented a distributed organizational model. At the Group level, the Group CISO defines the global cybersecurity strategy and roadmap. The global cybersecurity strategy and roadmap is informed by the ArcelorMittal Security Incident Classification and Escalation Procedures as well as the ArcelorMittal Cyber Crisis Management Procedures (collectively, the “Cybersecurity Procedures”). The Cybersecurity Procedures define the core principles of security risk management and the procedures for security management, including the roles and responsibilities of key personnel, strategy and measures to cope with information security breaches and related communication procedures. Every cybersecurity occurrence or threat that rises to a specific level defined in the Cybersecurity Procedures is reviewed in the various security councils set out below and communicated to the appropriate committees as defined in the Cybersecurity Procedures. Any such cyber incident is promptly reported by the Group CISO to (a) the Global Ransomware Crisis Committee and (b) the Group CFO and Disclosure Committee for decision- making regarding external communication to regulators or investors. I n fulfilling its oversight responsibilities, the Board oversees cyber risks and incidents via the Audit & Risk Committee and approves proposals or modifications to the Cybersecurity Procedures. The Audit & Risk Committee relies on information provided from Global Assurance , to which the Group CFO provides information about risks. The Group CFO provides information to both the Audit & Risk Committee and the Group CEO. The following teams are organized under and report to the Group CISO: • the Group Chief Information Officer (“CIO”) Council (headed by the Group CISO and made up of segment CIOs and other specialists) leads and manages the different business segments, which are responsible for the implementation and management of security controls, processes and technology within their respective business segments. • the Group Cybersecurity (“CS”) Leadership team led by the Group CISO and consisting of security officers from each segment, is responsible for decision-making relating to all security topics, defining roadmaps and execution of strategies and protection within their respective segments. • the Global Ransomware Crisis Committee made up of various heads of leadership functions such as Legal