Information Security-Cybersecurity

Cybersecurity Governance and Policy

Cybersecurity is central to IRPC’s digital transformation efforts. The Cyber Security Policy has been in place since 2019 to ensure comprehensive cybersecurity management. The policy emphasizes continuous improvement of security systems through regular risk assessments, threat monitoring, and periodic reviews to strengthen resilience. It safeguards the integrity and confidentiality of data using technical safeguards, operational controls, and secure processes. Proactive monitoring and rapid response to emerging threats are supported by incident response plans and business continuity measures. Clear accountability is established for departments, employees, and contractors, reinforced through ongoing training and awareness programs. The policy extends cybersecurity requirements to suppliers and partners, included in the Supplier Code of Conduct (Business Ethics section) covering data confidentiality and protection.

Oversight of cybersecurity is provided at the board level by the Risk Management Committee, with the support of the Senior Executive Vice President for Corporate Organization Effectiveness and Digital, ensuring executive-level accountability for information security. All employees are responsible for following the escalation process and reporting any suspicious activities, including system malfunctions, phishing attempts, or hacking incidents, to supervisors or the IT Helpdesk. Information Security and Cybersecurity performance are integrated into employee performance assessments, with disciplinary measures applied for non-compliance. Cybersecurity is also monitored as a key performance indicator (KPI) for IT personnel, supporting proactive oversight, effective risk management, and mitigation of cyber threats across the organization.

Cybersecurity

Cybersecurity Management and Process

IRPC adheres to cybersecurity practices aligned with the ISO 27001 standard for cybersecurity management systems in combination with the NIST Cybersecurity Framework (US National Institute of Standards and Technology), which consists of 5 core functions:

1. Identify: Enhance understanding within the organization to manage cybersecurity risks affecting systems, assets, data, and capabilities.
2. Protect: Develop and implement safeguards to ensure the continuous delivery of critical infrastructure services.
3. Detect: Implement activities to identify cybersecurity incidents promptly.
4. Respond: Establish actions to address detected cybersecurity incidents effectively.
5. Recover: Create contingency plans and recovery activities to ensure the restoration of capabilities or services compromised by cybersecurity incidents.

Building on this framework, IRPC has implemented key information security programs to strengthen operational resilience, safeguard critical data, and ensure continuity of business functions. These programs include:

• Business continuity planning: Establishing and regularly testing business continuity and disaster recovery plans to ensure critical operations can continue during disruptions.
• Vulnerability analysis: Conducting ongoing vulnerability assessments and penetration testing to identify security weaknesses and proactively mitigate cyber risks.
• Internal and external audits: Conducting regular audits under the ISO 27001 Information Security Management System framework to ensure ongoing compliance, strengthen control effectiveness, and support continuous enhancement of the organization’s cybersecurity posture.
• Incident reporting and awareness: A structured escalation process for employees to report incidents, vulnerabilities, or suspicious activities, supported by ongoing information security awareness training to enhance competence and preparedness.

IRPC recognizes cybersecurity resilience as a fundamental enabler of sustainable digital transformation, ensuring that critical systems, data, and operations remain secure, available, and trustworthy at all times. The Company has established a comprehensive cybersecurity framework built on three interdependent pillars — Secure People, Strengthen Process, and Smart Technology — embedding defense across every layer of the organization. IRPC’s key to success lies in the holistic integration of an empowered human firewall, well-prepared response processes, and automated security technologies that collectively minimize risk and safeguard continuous operations.

Digitalization

IRPC’s Digitalization Strategy is anchored on three strategic pillars designed to drive sustainable value creation across the organization. The first pillar, High Performance Organization, focuses on automating core business processes through RPA and ERP integration to optimize operational efficiency, reduce costs, and rationalize FTE utilization. The second pillar, High Performance People by Data-Driven Culture, aims to cultivate a data-literate workforce equipped with the skills, mindset, and analytical tools necessary to make informed decisions and elevate organizational performance. The third pillar, High Revenue Organization, leverages IRPC’s digital capabilities, asset base, and institutional knowledge to develop new revenue streams and enhance value delivery to customers and stakeholders. Together, these pillars form an integrated digital ecosystem that enables IRPC to compete effectively, operate responsibly, and achieve its long-term strategy.

IRPC operationalizes our strategy through targeted projects that enhance performance, visibility, and operational efficiency:

IRPC believes people are the most critical driver of digitalization success, focusing on building a digitally empowered workforce with the right mindset, skills, and collaborative spirit. To cultivate a digital culture, the Company organized awareness events, roadshows, and learning programs covering data literacy and digital tools across all business units. A cross-functional Digital Hackathon was also held, challenging employees to prototype solutions for real business problems — with selected ideas fast-tracked into formal projects, ensuring employee-driven innovation delivers tangible outcomes.

IRPC achieved significant progress across both digitalization and cybersecurity, delivering measurable gains in process efficiency, workforce capability, and data-driven decision-making. The Company successfully maintained zero critical cyber-attack incidents through its Secure People, Strengthen Process, and Smart Technology framework — ensuring business continuity and operational resilience throughout the year. Together, these achievements position IRPC on a strong trajectory toward its long-term digital and sustainability targets through 2030.