Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 218

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 16K
Chunk 218
---
Item 16K. Cybersecurity

Infosys Cybersecurity integrates a robust strategy with a comprehensive framework and a strong governance program to ensure optimal protection. The primary objective of Infosys's cybersecurity strategy is to ensure business continuity by minimizing disruptions, besides ensuring continual improvement in the security compliance posture. This is achieved through an effective and continuous threat landscape monitoring system and management of cyber events leveraging advanced tools, technology, processes, and domain expertise. Infosys believes in nurturing a security-first mindset and upholding an effective security culture in the organization, thus complementing its cybersecurity objectives and mitigating enterprise risks. The cybersecurity program is designed to ensure that necessary controls and processes are consistently implemented, monitored, measured, and improved to address cyber risks across all cybersecurity domains. There is a focus on embracing technological innovation, secure by design principles, strengthening the cyber resilient core, and ensuring robust governance.

Risk management and strategy

Infosys maintains an integrated Enterprise Risk Management (ERM) framework that is implemented across the organization by the risk management office. Our ERM framework is developed with reference to the Committee of Sponsoring Organizations (COSO) and the International Organization for Standardization (ISO) 31000 and is tailored to suit our unique business requirements. Our ERM framework is designed to encompass all of the Company’s risks, such as strategic, operational, legal and compliance risks. The ERM function enables the achievement of the Company’s strategic objectives by identifying, analyzing, assessing, mitigating, monitoring, and governing any risks, vulnerabilities, or potential threat to these objectives. While this is the key driver, our values, culture, and commitment to stakeholders – employees, customers, investors, regulatory bodies, partners, and the community around us – are the foundation for our ERM framework. Our efforts to ensure the systematic and proactive identification of risks, and mitigation thereof, enables our organization to boost performance with effective and timely decision-making. Risks to the strategic goals are identified through a mix of top-down and bottom-up approaches and are included in a multi-layer risk register. Infosys’s ERM framework has defined organization-wide risk assessment guidelines and has set up an eight-layer governance structure, covering categories of risks. Risks identified in different functions including cybersecurity risks are presented at appropriate councils in the governance structure. Our ERM framework includes processes to escalate critical risks or cross-functional risks at each level to the next level in the ERM governance structure. ERM is also involved in defining the guidelines for incident management process at Infosys. Cybersecurity is one of the key