Company: ARBB
Filing Date: 2025-10-31
Form Type: 20-F
Source: 0001213900-25-104705
Chunk: 111

Company: ARB IOT Group Ltd
Filing Date: 2025-10-31
Form: 20-F
Item: Item 16K
Chunk 111
---
ITEM 16K. CYBERSECURITY

Risk Management and Strategy

We maintain a technology and cybersecurity program,
which includes information security, as part of our overall risk management process with the aim that our information systems, including
those of our suppliers and other third-parties, will be resilient, effective and capable of safeguarding against emerging risks and cybersecurity
threats. We endeavor to assure our program is appropriately resourced and to attract and retain expert talent to execute it.

Currently, the program is based on the regulations
on cybersecurity in Malaysia, aiming to comply with applicable laws and regulations. Please refer to “ Item 4B. Business Overview - Regulations - Regulations
on Cybersecurity” for more information on applicable regulations in Malaysia. We use such regulations as a guideline to help us
identify, assess, and manage cybersecurity risks related to our business operations.

Under cybersecurity regulations in Malaysia, we
have established preventive measures that are consistent with the national cybersecurity standards. We fulfill our security obligations
to protect our networks from interference, damage, or unauthorized access, and to prevent the leakage, theft, or alteration of network
data. As part of our supplier risk management program, we conduct security assessments prior to engagement of high-risk suppliers and
otherthird-partyproviders and have a monitoring program to evaluate ongoing compliance with our cybersecurity standards.

A key element of our technology and cybersecurity
program strategy is fostering training and awareness. Our training and awareness program includes annual cybersecurity awareness training
and role-based phishing tests for our employees and for third parties with access to our systems.

Our technology and cybersecurity program focuses
on the defense, rapid detection and rapid remediation of cybersecurity threats and incidents. Our approach aims to deliver the control
capabilities specified in the Malaysian cybersecurity regulations. Additionally, our program incorporates comprehensive cybersecurity
policies and crisis response and management procedures, aimed at rapidly addressing, responding to, and effectively communicating about
cybersecurity threats and incident.

Our cybersecurity crisis management program sets
forth the items, procedures and actions we expect to address and follow in the event of a cybersecurity incident, including detection,
response, mitigation and remediation. When a potential threat or incident is identified, our cyber security incident response team will
assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially
assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our Chief Executive Officer, who
will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including