Company: RTNTF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001628280-25-006642
Chunk: 502

Company: RIO TINTO LTD
Filing Date: 2025-02-20
Form: 20-F
Chunk 502
---
ovski     | Head of Group Risk                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Richard Cohen      | Operational Managing Director from aproduct group (currently Rio TintoIron Ore). |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

| Annual Report on Form 20-F 2024 | 337 | riotinto.com |

Additional information | US Disclosure Risk management Group risk management process Cyber security risk exposures are managed consistent with the Group risk management process, which can be described as a plan-do- check-act cycle. See “Our approach to risk management” on pages 88-90 . The following steps of our Group risk management process are applicable to cyber security: – Set strategy, objectives and risk appetite We review our Cyber Security Strategy, objectives and risk appetite after improvements in controls and actions. – Risk analysis Managers delivering our business objectives must identify potential risks against a common risk taxonomy, which includes a category for information and cyber security. Where exposure is identified, the accountable manager uses a universal evaluation scheme to assess the potential impact of a cyber security event. – Risk management Where material consequences are identified, there is a common set of 8 Group controls that the risk owner is responsible for implementing, with support from Cyber Security as required. These governance controls ensure a considered level of engagement and collaboration with the Cyber Security team and the services they offer, commensurate with the risk. – Assurance Cyber Security, as owner of the Group controls, will oversee and support their implementation and operation in line with the Group control framework. Where we have material exposure, the first line of assurance and verification of these controls will be incorporated into first-line assurance plans. Risk profiles and trends inform second- and third-line assurance. – Communication Cyber security risk exposure is communicated as part of integrated risk reporting processes and can be escalated through standard risk escalation channels. Beyond this, there is extensive monitoring of the performance of critical controls, which is communicated to control owners and the CSSC. – Improvement Where exposure to cyber security risk is outside of tolerance, as highlighted in risk profiles or through assurance activity, Cyber Security will support or sponsor improvement initiatives through the business planning process. Cyber security risk management framework The management of cyber security is a focus across all IT operations and projects for our business and the third parties we rely on. Our cyber security risk management framework is based on the globally recognised NIST CSF. In aligning to this framework, we maintain a control environment supported by dedicated functions covering identification, protection and control, detection, response and recovery from cyber incidents. We also inspect and assure on an