Operating ethically

Cyber Security

Cyber security breaches are a material risk to our business. Our proactive approach includes identifying and assessing risks, and taking steps to reduce the likelihood and impacts of an incident.

Our Group-wide cyber security program is designed to uplift capability and reduce exposure to cyber threats through effective controls. The controls we implement are designed and operated in alignment with the National Institute of Standards and Technology Cybersecurity Framework, an international best practice standard for information security controls. Continuous monitoring and periodic reporting occur through pre-defined metrics that measure the performance of security controls.

We engage independent auditors annually to review the adequacy of our cyber security risk management system and information security controls. Critical cyber security controls are also periodically assessed through a comprehensive stewardship program.

Cyber security awareness training is mandatory for all employees and select contractors on joining South32 and annually thereafter. We provide additional targeted cyber security training to identified high-risk roles.

The Board’s Risk and Audit Committee is responsible for overseeing our management of the cyber security and reviewing the effectiveness of systems and processes for detecting, reporting and responding to cybersecurity and information loss risks. The Committee receives bi-annual reports on our information security risk management plan and control maturity levels.