Company: PBR
Filing Date: 2025-04-03
Form Type: 20-F
Source: 0001292814-25-001352
Chunk: 43

Company: PETROBRAS - PETROLEO BRASILEIRO SA
Filing Date: 2025-04-03
Form: 20-F
Item: Item 17
Chunk 43
---
security Policy and the National Cybersecurity Committee,
while Normative Instruction 1/2020 GSI/PR (Institutional Security Office) guides the structure for managing information security, including   
the establishment of the Information Security Committee (the “CSI”). Additionally, we comply with other general rules such                    
as Brazilian Law No. 12.527/2011 (Access to Information Law), which governs public access to information.                                     
With                                                                                                                                          
regards to privacy, we comply with Brazilian Law No. 13,709/2018 – General Personal Data Protection Law (LGPD), and are subject               
to penalties in cases of disclosure or misuse of personal data. We view the legislation on the protection of personal data as an opportunity  
to evolve our system to greater maturity, adding continuous improvements to our privacy processes. To achieve excellence, the process         
is conducted through a governance model, and the adoption of technical and administrative measures to respond to legal requirements,          
mitigate data breach risks and guarantee the data rights of our workforce and stakeholders as data subjects.                                  
Governance
 Management Structure

 We have a dedicated Information Security executive management structure (SI), which operates independently from the Information Technology (IT) department. This structure is responsible for overseeing information security initiatives, establishing strategies and guidelines aligned with business objectives, recommending investments to mitigate cyber risks, and providing adequate digital protection for critical assets. Both the SI and IT report to the Chief Corporate Affairs Officer.

 The Chief Information Security Officer, Samara Braz, leads the information security efforts and holds multiple qualifications in IT and Information Security, including the following:

  

–                                               Certified                                            
    in the Governance of Enterprise IT (CGEIT) from Information Systems Audit and Control Association
                                                (“ISACA”);                                           
-----------------------------------------------------------------------------------------------------

–                            Certified                         
    in Risk and Information Systems Control (CRISC) from ISACA;
---------------------------------------------------------------

Annual Report and Form 20-F 2024 |

–                        Certified                     
    Data Privacy Solutions Engineer (CDPSE) from ISACA;
-------------------------------------------------------

–                      Certified                   
    Information Security Manager (CISM) from ISACA;
---------------------------------------------------

–                       Certified                    
    Information Systems Auditor (CISA) from ISACA and
-----------------------------------------------------

–                                              Certified                                           
    Chief Information Security Officer (CCISO) from International Council of E-Commerce Consultants
                                             (EC-Council).                                         
---------------------------------------------------------------------------------------------------
<{self.tag} alt="{self.alt}" src="{self.src}"> 
Additionally, we have an Information Security Committee (CSI) composed of members