Company: CRESW
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001654954-25-012195
Chunk: 410

Company: CRESUD INC
Filing Date: 2025-10-24
Form: 20-F
Item: Item 16
Chunk 410
---
 treated or accepted; (ii) we deepened cybersecurity training for our employees with the aim of updating knowledge about threats, adding artificial intelligence as a new risk factor, and distributing tips and best practices to reduce the probability of incidents, minimize potential impact, and strengthen organizational resilience against increasingly sophisticated attacks; (iii) we updated technological equipment that allowed us to keep our hardware fleet on the manufacturers’ latest versions, minimizing the threats published by them. These actions deepen our commitment to cybersecurity management, increase protection against threats, and build an adequate environment for the organization.

In recent years, the average number of cybersecurity incidents has increased significantly worldwide. Therefore, we focus on using advanced threat detection and blocking tools that allow us to prevent the most frequent cyberattacks, which are related to ransomware (hacking of virtual files), malware, spam, phishing, and executive impersonation (BEC—Business Email Compromise), among others.

Our Information Security Manager provides quarterly reports on cybersecurity to our Audit Committee, which assumes responsibility for the strategy and oversight of cybersecurity issues. This allows involving senior management, providing knowledge of the status of each action taken, and adjusting the strategy based on the needs and direction of the business.

We have a cybersecurity incident response process to report to our Executive Committee, Audit Committee, and the SEC information about cybersecurity incidents that have had a significant impact on the Company. Our Information Security Manager is responsible for managing and resolving cybersecurity incidents that affect the Company. His main responsibilities include supervising the security detection and alert system, notifying relevant parties about detected incidents, conducting initial assessments of incidents, isolating compromised systems, coordinating recovery efforts with our IT management, investigating cybersecurity incidents, managing internal communication about incidents, and reviewing the effectiveness of implemented corrective and preventive measures.

We also have a Crisis Committee whose responsibilities include managing unforeseen situations that can negatively affect the Company’s operations and assets, coordinating a quick and effective response to a cybersecurity crisis, managing internal and external communication during the crisis, making critical real-time decisions, constantly evaluating the impact of the situation, adjusting decisions, and ensuring compliance with applicable laws and regulations.

Also, our Compliance Manager is responsible for ensuring that the Company complies with all laws, regulations, and standards related to the management of cybersecurity incidents applicable to it, cooperating with regulatory entities, promoting the review and updating of policies and procedures, acting as a spokesperson for the Executive Committee, and keeping the Executive Committee and the Audit Committee informed about the status of the Company’s regulatory and legal compliance.

Additionally, our legal management receives reports on cybersecurity incidents, cooper