Company: TEN-PE
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-079101
Chunk: 203

Company: TSAKOS ENERGY NAVIGATION LTD
Filing Date: 2025-04-11
Form: 20-F
Item: Item 16K
Chunk 203
---
Item 16K. Cybersecurity

Risk Management and Strategy

In the rapidly evolving landscape of modern maritime operations, cybersecurity stands as a vital enabler. With the continual influx of disruptive technologies to meet industry demands and the rise of new cybersecurity threats, the Company acknowledges the necessity of integrating cyber risk management into our safety management system. Adequate investment in security technologies, systems, processes, and personnel is essential to support this endeavor effectively.

Given the multifaceted nature of cybersecurity threats, establishing a comprehensive approach is challenging. However, recognizing the vulnerabilities inherent in our global supply chain ecosystem and the volatile geopolitical environment, we prioritize ongoing review and updates to our strategy, with a focus on key risk areas.

The imperative to deliver applications and information securely across diverse devices underscores the need for robust cybersecurity measures, both ashore and aboard vessels. To this end, our cybersecurity risk management encompasses several key components:

  Employee Training and Awareness: Regular training sessions and awareness programs reinforce our Acceptable Use Policies, recognizing the crucial role of the human element in defending against c...  

  Technical Measures: Implementation of industry-accepted technical safeguards, including network configurations, access controls, and detection software, helps fortify our systems against cyber ...  

  Periodic Monitoring: We employ ongoing monitoring mechanisms to track internal and external cybersecurity threats, ensuring timely response and mitigation.  

  Knowledge Sharing: Engagement in webinars, seminars, and forums facilitates the gathering and dissemination of threat intelligence, enriching our internal audit and compliance efforts.  

  Third-party Evaluations: Periodic assessments by external consultants help evaluate the effectiveness of our security controls and identify potential vulnerabilities.  

Regular audits and reviews of our cybersecurity policies and controls, conducted both internally and externally, provide assurance of our commitment to maintaining robust defenses. Incidents are promptly reported, assessed, and escalated as necessary, with incident response processes geared towards minimizing impact and ensuring business continuity.

Governance

Our governance structure supports effective oversight of cybersecurity risks. The IT department implements, maintains, and monitors our cybersecurity program, while Management oversees day-to-day risk management. Management updates the Audit Committee of the Board of Directors on the cybersecurity program as well as potential cyber threats, mitigation efforts, and the effectiveness of internal controls during its regular meetings. The Audit Committee provides overall oversight of the cybersecurity framework, including significant incidents, disclosure compliance, coordination with law enforcement, and related financial and operational impacts.

Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially