Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Jun. 30, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Harmony’s cybersecurity governance employs a comprehensive and integrated approach to risk management, engaging both internal teams and third-party service providers. Harmony has established protocols for continuous monitoring and proactive management of cybersecurity threats through daily and weekly meetings and continuous interactions with its 24X7 outsourced Security Operations Centre (“SOC”). The SOC regularly engages with Harmony’s internal cybersecurity team to address identified threats and vulnerabilities. Harmony’s strategy includes monthly cross-departmental management meetings where cyber risk is discussed. External penetration tests and internal phishing simulations are conducted bi-annually to evaluate and enhance incident response capabilities and employee awareness. Cyber incident response plans are documented including detailed playbooks designed to enable timely response and recovery in the event of a cyber incident. Cybersecurity processes are fully integrated into Harmony's broader enterprise risk management system. The continuous engagement between Harmony’s internal cybersecurity team, technology stakeholders, and the SOC underscores Harmony’s comprehensive approach to risk assessment and mitigation. The head of the department for cybersecurity (''Manager: CyberSecurity''), meets with the Group Chief Technology and Information Officer (“GCTIO”) on a weekly basis. In addition, quarterly Technology and Information Systems Steering Committee meetings including representatives from Group Internal Audit, Enterprise Risk Management, Security, Operations, Safety, and Compliance. Harmony routinely engages third parties in its cybersecurity operations. These engagements include: •Consulting with external experts to provide specialized cybersecurity services, including penetration testing. •Utilising an internal training platform to deliver and monitor cyber awareness training modules ensuring employees remain current on best practices. •Collaborating with operational technology to address specific cybersecurity challenges in operational environments; and •Outsourcing its ’s SOC to a managed service provided that operates continuously, providing round-the-clock monitoring and response to cybersecurity threats. •Periodic reviews are also conducted by Group Internal Audit using the National Institute of Standards and Technology framework (''NIST framework") and the Center for Internet Security Framework ("CIS framework") as benchmarks to assess cybersecurity readiness. Harmony engages with vendors that have access to the its network, requiring their compliance with Harmony's Cybersecurity Awareness Training mandate. This initiative emphasizes completion of training campaigns and awareness of key cyber risks, such as phishing. Harmony has also introduced a process to include cybersecurity clauses in all new vendor contracts to ensure service level agreements, roles and responsibilities for managing cyber threats are clearly defined. For existing contracts , these clauses are incorporated upon amendment or renewal. This initiative is part of a broader effort to embed Harmony’s cybersecurity standards into all third-party relationships.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Harmony’s cybersecurity governance employs a comprehensive and integrated approach to risk management, engaging both internal teams and third-party service providers. Harmony has established protocols for continuous monitoring and proactive management of cybersecurity threats through daily and weekly meetings and continuous interactions with its 24X7 outsourced Security Operations Centre (“SOC”). The SOC regularly engages with Harmony’s internal cybersecurity team to address identified threats and vulnerabilities. Harmony’s strategy includes monthly cross-departmental management meetings where cyber risk is discussed. External penetration tests and internal phishing simulations are conducted bi-annually to evaluate and enhance incident response capabilities and employee awareness. Cyber incident response plans are documented including detailed playbooks designed to enable timely response and recovery in the event of a cyber incident. Cybersecurity processes are fully integrated into Harmony's broader enterprise risk management system. The continuous engagement between Harmony’s internal cybersecurity team, technology stakeholders, and the SOC underscores Harmony’s comprehensive approach to risk assessment and mitigation. The head of the department for cybersecurity (''Manager: CyberSecurity''), meets with the Group Chief Technology and Information Officer (“GCTIO”) on a weekly basis. In addition, quarterly Technology and Information Systems Steering Committee meetings including representatives from Group Internal Audit, Enterprise Risk Management, Security, Operations, Safety, and Compliance. Harmony routinely engages third parties in its cybersecurity operations. These engagements include: •Consulting with external experts to provide specialized cybersecurity services, including penetration testing. •Utilising an internal training platform to deliver and monitor cyber awareness training modules ensuring employees remain current on best practices. •Collaborating with operational technology to address specific cybersecurity challenges in operational environments; and •Outsourcing its ’s SOC to a managed service provided that operates continuously, providing round-the-clock monitoring and response to cybersecurity threats. •Periodic reviews are also conducted by Group Internal Audit using the National Institute of Standards and Technology framework (''NIST framework") and the Center for Internet Security Framework ("CIS framework") as benchmarks to assess cybersecurity readiness. Harmony engages with vendors that have access to the its network, requiring their compliance with Harmony's Cybersecurity Awareness Training mandate. This initiative emphasizes completion of training campaigns and awareness of key cyber risks, such as phishing. Harmony has also introduced a process to include cybersecurity clauses in all new vendor contracts to ensure service level agreements, roles and responsibilities for managing cyber threats are clearly defined. For existing contracts , these clauses are incorporated upon amendment or renewal. This initiative is part of a broader effort to embed Harmony’s cybersecurity standards into all third-party relationships. Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management , including the GCTIO, the Manager: Cybersecurity and various management committees,such as the Enterprise Architecture, Change/Project Delivery, and Technology Steering Committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group Technology Strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides . regular updates to the GCTIO during weekly one-on-one meetings and monthly Group Technology Management Committee sessions. This structured communication flow enables the GCTIO to provide updates to the Executive Committee and the Audit and Risk Committee. Group Enterprise Risk Management and Group Internal Audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group Internal Audit, Group Risk Management, Security and Compliance participate in quarterly Technology and Information Steering Committee meetings. From a disclosure perspective, the Executive Committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | Breaches in cybersecurity may adversely impact or disrupt our business The mining industry has become increasingly reliant on digital technologies. These technologies enable us to conduct our day-to-day operations, improve safety and efficiency and decrease costs. However, as reliance on technology increases, we become more susceptible to the persistent threat of cybersecurity breaches, such as cyber-crime, ransomware or cyber activist attacks. We maintain global information, digital technology and communication networks and applications to support our business activities. We outsource several digital technology functions and applications to third-party vendors and these engagements may have an impact on our overall cybersecurity position. Aspects of Harmony's information technology platform that are managed by third-party vendors include cloud infrastructure, data centre management, server/personal computing support, enterprise resource planning, business applications, email and digital documents. The sophistication and magnitude of cybersecurity incidents are increasing and include malicious software, ransomware and other attempts to gain unauthorised access to data and other electronic security and protected information breaches that could lead to production downtimes, operational delays, safety incidents, the compromising of confidential or otherwise protected information, destruction or corruption of data, other manipulation or improper use of Harmony's systems and networks. Cyber breaches via third-party solutions have also become increasingly frequent. Digital technology security processes may not prevent future malicious actions, denial-of-service attacks, or fraud, which could result in the corruption of operating systems, theft of commercially sensitive data, misappropriation of funds and business and operational disruption. While our insurance program includes limited coverage for cyber-related crimes and incidents, there can be no assurance that any cybersecurity incident will be adequately covered by insurance, if at all. Any cybersecurity attack could significantly disrupt our mining operations and cause us to suffer financial losses, including the cost of remedial actions, the loss of revenue, and reputational harms. We undertake various measures to follow the established best practices in relation to cyber security. However, the increasing sophistication and evolving nature of cybersecurity threats may lead to future cybersecurity breaches, and sophisticated cyber-attacks (such as phishing and ransomware attacks) despite our efforts. This is particularly the case with new and evolving technologies such AI, including generative AI. As these technologies continue to improve and gain widespread use, we may experience cybersecurity attacks created using AI, which may be difficult to detect and defend against. See Item 16K: ''Cybersecurity''.
|
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Board Oversight Harmony has established mechanisms to ensure that both the Board of Directors and the Audit and Risk Committee are regularly informed of cybersecurity threats and the measures taken to address them. The GCTIO, supported by the Manager: Cybersecurity, provides regular updates to these bodies, including discussions of material cybersecurity incidents, vulnerabilities, defences, and planned response strategies. The GCTIO attends Audit and Risk Committee meetings and reports back any feedback or recommendations to management. Together, the GCTIO and the Manager: Cybersecurity ensure that material cyber risks are appropriately escalated to the Board via the Audit and Risk Committee. Additionally, the Chief Audit Executive, whose mandate includes cybersecurity, maintains a direct reporting line to both the Audit and Risk Committee and the Chairperson of the Board, providing multiple channels for oversight and assurance.
|
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Harmony has established mechanisms to ensure that both the Board of Directors and the Audit and Risk Committee are regularly informed of cybersecurity threats and the measures taken to address them. The GCTIO, supported by the Manager: Cybersecurity, provides regular updates to these bodies, including discussions of material cybersecurity incidents, vulnerabilities, defences, and planned response strategies. The GCTIO attends Audit and Risk Committee meetings and reports back any feedback or recommendations to management. Together, the GCTIO and the Manager: Cybersecurity ensure that material cyber risks are appropriately escalated to the Board via the Audit and Risk Committee. Additionally, the Chief Audit Executive, whose mandate includes cybersecurity, maintains a direct reporting line to both the Audit and Risk Committee and the Chairperson of the Board, providing multiple channels for oversight and assurance.
|
| Cybersecurity Risk Role of Management [Text Block] | Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management , including the GCTIO, the Manager: Cybersecurity and various management committees,such as the Enterprise Architecture, Change/Project Delivery, and Technology Steering Committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group Technology Strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides . regular updates to the GCTIO during weekly one-on-one meetings and monthly Group Technology Management Committee sessions. This structured communication flow enables the GCTIO to provide updates to the Executive Committee and the Audit and Risk Committee. Group Enterprise Risk Management and Group Internal Audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group Internal Audit, Group Risk Management, Security and Compliance participate in quarterly Technology and Information Steering Committee meetings. From a disclosure perspective, the Executive Committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management , including the GCTIO, the Manager: Cybersecurity and various management committees,such as the Enterprise Architecture, Change/Project Delivery, and Technology Steering Committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group Technology Strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides . regular updates to the GCTIO during weekly one-on-one meetings and monthly Group Technology Management Committee sessions. This structured communication flow enables the GCTIO to provide updates to the Executive Committee and the Audit and Risk Committee. Group Enterprise Risk Management and Group Internal Audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group Internal Audit, Group Risk Management, Security and Compliance participate in quarterly Technology and Information Steering Committee meetings. From a disclosure perspective, the Executive Committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Dr Hendrik Kotze – Group CTIO B Com (Commercial Computer Science) - University of Pretoria MBA International Business Doctor of Philosophy – Kairos University, USA The Group CIO is responsible for managing the entire technology infrastructure of Harmony, including hardware, software, networks, and data centres, ensuring that these systems are reliable, secure, and scalable to meet the organisation's evolving needs. Stanley Pautz – Manager: Cybersecurity B Com (Internal Audit), University of Pretoria Certified Information Systems Auditor - ISACA Certified in Risk and Information Systems Control - ISACA CIA – Certified Internal Auditor (IIA – not maintained) The HOD: CyberSecurity ensures that the entire technology landscape is overseen, secure and safe in line with the business and technology strategies. Dr Christiaan Roos - Lead: Cybersecurity operations D Com (PhD), IT Audit, IT Governance and Ethical Hacking, University of Johannesburg CEH – Certified Ethical Hacker Project Management Professional (PMP), Project Management Institute Dr Roos was contracted as vCISO of Harmony with effect from 1 March 2021
|
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management , including the GCTIO, the Manager: Cybersecurity and various management committees,such as the Enterprise Architecture, Change/Project Delivery, and Technology Steering Committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group Technology Strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides . regular updates to the GCTIO during weekly one-on-one meetings and monthly Group Technology Management Committee sessions. This structured communication flow enables the GCTIO to provide updates to the Executive Committee and the Audit and Risk Committee. Group Enterprise Risk Management and Group Internal Audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group Internal Audit, Group Risk Management, Security and Compliance participate in quarterly Technology and Information Steering Committee meetings. From a disclosure perspective, the Executive Committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |