Company: TCMFF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0001104659-25-019133
Chunk: 246

Company: TELECOM ARGENTINA SA
Filing Date: 2025-02-28
Form: 20-F
Item: Item 16K
Chunk 246
---
, and businesses;
---------------------------------------------------------------------------------------------------------------------------------------------------------------------

-   Maintaining and developing cybersecurity policies and controls to ensure compliance with the mentioned standards and regulations;
-------------------------------------------------------------------------------------------------------------------------------------

-   Conducting a comprehensive and thorough review of the credit card data processing environment in accordance with the PCI DSS, for which certification for the year 2023 was obtained in early 2024. As of the date of this Annual Report, the Department of Cybersecurity is in the process of obtaining the recertification for the year 2024; and
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

-   Assessing each cyber event and evaluating its consequences after the attack has been mitigated, among others.
-----------------------------------------------------------------------------------------------------------------
​
The Cybersecurity Department’s processes are annually reviewed, tested, updated and approved by the GRCI Department. If updates to the processes arise from the review, they are carried out according to the requirements of the Company and in agreement with other areas of the Company. The final review of the processes is carried out by the CISO.
​
The Company’s incident response and prevention process, depending on the Cybersecurity Department of Telecom includes the following elements: incident response, security awareness and training, penetration testing, vulnerability management, security monitoring, threat detection and response, and threat intelligence.
​
The Company does not engage consultant services to carry out its cybersecurity processes. However, Telecom contracted the PCI audit service, since a Qualified Security Assessor (QSA) is needed to provide such certification.
​
As of the date of this Annual Report, our insurance policy does not cover damages caused by cyberattacks and other similar events.
​
Third-Party Service Provider
​
Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers, subject to the terms of the contract established with them. We require in our contracts that third-party services comply with our security policies through Request for Proposals (RFPs).
​
The Department of Cybersecurity oversees the process and, if any risk is detected, instructs them to comply with the Company’s cybersecurity policies.
​
Training 
​
The Department of Cybersecurity conducts awareness campaigns and training sessions for employees with a focus on: Secure passwords, phishing, social engineering, PCI DSS standards, data leakage, security on WhatsApp and social networks, data protection, and secure development, among others.
​
Incident Response Plan
​
We have a critical incident notification process that actively involves and engages the Department of Cybersecurity along with areas such as: Data Center