Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cybersecurity Risk Management Model For cybersecurity risks, we maintain structured processes for the assessment, classification, and treatment of risks, integrated into our corporate risk management framework. These processes aim to identify, based on scenarios and factors inherent to our activities, threats that may significantly impact our operations, IT environment, customer data, and corporate information. Our model seeks to ensure that the area responsible for cybersecurity risk management can continuously assess the nature and materiality of baseline risks and define, on a case-by-case basis, response strategies consistent with our risk appetite and the catalog of technology services we utilize. When deemed relevant, these risks are submitted to the appropriate governance bodies for analysis and deliberation. Cybersecurity risks identified as high or critical are reported to the management responsible for the respective risk area, as well as to the executive cybersecurity risk committee, which meets periodically to monitor such exposures. This committee is composed of senior management members, including executives responsible for technology, risk, internal controls, and information security, and aims to support awareness and decision-making regarding prevention, mitigation, and incident response measures. Cybersecurity risks that meet the defined materiality thresholds outlined in our internal policies are consolidated into corporate risk management reports and, where applicable, presented to the audit committee, the control committee, and the board of directors, in accordance with our governance structures. This process is designed to provide visibility, at different hierarchical levels, regarding cybersecurity risks that may significantly impact our business, operational results, or financial condition. Despite these processes and the adoption of technical and organizational controls, we cannot guarantee that all cybersecurity risks will be fully eliminated or that we will not experience significant incidents in the future. Cybersecurity events, including those arising from internal failures, third parties, or malicious agents, may lead to operational disruptions, loss or improper disclosure of data, reputational damage, additional remediation costs, litigation, regulatory sanctions, and other significant adverse impacts.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | For cybersecurity risks, we maintain structured processes for the assessment, classification, and treatment of risks, integrated into our corporate risk management framework. These processes aim to identify, based on scenarios and factors inherent to our activities, threats that may significantly impact our operations, IT environment, customer data, and corporate information.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Enterprise Risk Management In accordance with our principles of corporate governance and responsible business practices, we have adopted a structured approach to identify, assess, monitor, and manage relevant risks to which we are exposed. This approach aims to support decision-making, strategy execution, and the protection of the Company's long-term value, recognizing that risk management is a shared responsibility throughout the organization. The Board of Directors holds overall responsibility for overseeing our enterprise risk management framework, including risks related to cybersecurity. According to its internal regulations, the Board delegates more detailed oversight of risk management processes, internal controls, and contingency plans to the Audit and Control Committee. The Audit and Control Committee supports the Board by periodically assessing the adequacy and effectiveness of these systems and processes. To support these oversight activities, an independent Corporate Risk Management area has been established, integrated into the internal audit structure. This area is responsible for overseeing the implementation of corporate risk management processes, as well as for supporting, coordinating, and promoting compliance with the guidelines defined in our corporate risk management policy, as approved by the Board of Directors. Our corporate risk management model is based on widely recognized market methodologies, including the framework from the Committee of Sponsoring Organizations of the Treadway Commission (COSO ERM). This approach seeks to align risk management with corporate strategy, allowing for the identification, prioritization, and monitoring of key risks, as well as the development of responses and mitigation actions in a coordinated and consistent manner. The internal audit regularly reports to the Audit and Control Committee information regarding the status of identified key business risks, including those related to cybersecurity, as well as the evolution of controls and associated mitigation actions. However, despite the existence of this governance structure and adopted processes, we cannot assure that all risks will be identified or mitigated in a timely or comprehensive manner.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Board of Directors |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | According to its internal regulations, the Board delegates more detailed oversight of risk management processes, internal controls, and contingency plans to the Audit and Control Committee. The Audit and Control Committee supports the Board by periodically assessing the adequacy and effectiveness of these systems and processes. |
| Cybersecurity Risk Role of Management [Text Block] | The Board of Directors holds overall responsibility for overseeing our enterprise risk management framework, including risks related to cybersecurity. According to its internal regulations, the Board delegates more detailed oversight of risk management processes, internal controls, and contingency plans to the Audit and Control Committee. The Audit and Control Committee supports the Board by periodically assessing the adequacy and effectiveness of these systems and processes.
|