v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Risk management and strategy
The Group Chief Information Security Officer and Head of
Cyber Risk follow the Group risk management program as
defined by the Global Assurance Enterprise Risk function in the
management of risks relating to the security of information
systems. For further information on the Global Assurance
team, see “Corporate governance—Sustainability committee—
Global Assurance”. The Group CISO is an experienced
information technology and operation technology executive. He
is a leading international chief information officer with proven
expertise in cyber security, digital transformation, IT integration
and business enablement. He joined ArcelorMittal in 2024 from
a leading transportation / logistics company where he served
as their IT senior vice president and international CIO from
2017. He holds an MBA in international management from the
Thunderbird School of Global Management, Glendale, Arizona,
USA, and a Bachelor of Engineering in electronics and
communication from the National Institute of Technology,
Trichy, India.
On a quarterly basis, the Group CISO provides a cybersecurity
risk report to the Group Finance Risk Committee, headed by
the Group CFO, based on risks identified at the segment level,
which in turn reports to and assists the Board of Directors in
fulfilling its oversight responsibilities with respect to legal and
regulatory requirements, including cybersecurity. Risks
identified in the report are considered potential risks that may
affect all functions and departments across the Group.
The office of the CISO has identified the following key risk
areas:
1.Cyber attacks related to extortion, state sponsored actors,
espionage or external threats resulting in financial loss;
2.Data breaches from exfiltration of Personal Data (PII) or
Intellectual Property (IP) resulting in financial loss;
3.Cyber fraud from external or internal actors;
4.Disruption of operations resulting from cyber-related
outages;
5.Impacts on the business resulting from third party or supply
chain cyber incidents;
6.Inability to recover from or restore services in timely manner
(business resilience);
7.Inability to identify, detect or prevent spread of attacks
across the Company (defensibility);
8.Regulatory fines, penalties or lawsuits due to
misrepresentation of material incidents, poor cyber practices,
or inadequate protection or usage of artificial intelligence
(“AI”) technologies; and
9.Negative company reputation resulting from a loss of
confidence with investors and partners due to poor cyber
assessments.
As part of the risk management process, the Group’s local IT
teams, segment CIOs and segment CISOs also identify local
cyber risks and report to the Group Finance Risk Committee.
The office of the CISO defines policies and procedures related
to cyber and information security as well as to the permissible
and secure uses of cloud, operational technology (“OT”) and
the internet of things ("IoT") within the Company. ArcelorMittal
follows the National Institute of Standards and Technology
Cybersecurity Framework ("NIST CSF"). The Group’s
cybersecurity policies and standards focus on protecting
information systems against disclosure to unauthorized users
(confidentiality), improper modification (integrity) and non-
access when required (availability). These polices are
implemented across the Group and the standards are tracked
and reported on a quarterly basis. Additionally, the Company
has in place a global incident and crisis process with special
procedures for ransomware and data privacy (e.g., to increase
protection and address breaches). Most Group entities
undergo periodic security penetration testing exercises led by
the Group CIO/ CISO team or external third parties throughout
the year. Global Assurance as part of risk based approach also
conducts penetration tests independently.
The Company engages a wide range of third parties as part of
the implementation and operationalization of its cybersecurity
policies, cyber defense strategies and general cyber risk
management, including specialist assessors, security
consultants, IT auditors, forensic analysts, malware analysts
and other third-party specialists. All third-party security
providers that handle Company data or otherwise have access
to ArcelorMittal’s network and systems are required to
complete a rigorous risk assessment program in an online
platform, which includes checks for data and cloud security,
access, incident reporting and physical protection in
accordance with the NIST CSF as well as applicable Company
cybersecurity policies.
In addition, Cyber Maturity Assessments are performed
annually by an external consultant across many entities and
segments for both IT and OT, as well as the Group Cyber
Governance and Technology program. Assessments are
interview and evidence-based exercises focusing on many key
cyber processes, such as Vulnerability and Incident
Management, Patching and Change Management, Malware
Protection, Network Monitoring, Business Continuity and
Disaster Recovery, and Software Security. Additionally, Global
Assurance, as part of its risk based approach, performs cyber
audits and penetration tests (as part of the annual plan).
ArcelorMittal has been a long-standing customer of the BitSight
risk rating service and has defined specific target levels and
KPIs for cybersecurity in the BitSight platform. These risk
measures are monitored daily and reported quarterly to the
Data Protection Committee, led by the Group Data Protection
Officer with representation from Group Compliance, Group HR
and the Group CISO. BitSight also reports ArcelorMittal’s risk
profile to Glass-Lewis for purposes of investor reporting.
The office of the CISO has put in place an extensive online
dashboard and reporting process that tracks various metrics
related to cybersecurity risks across various operating units.
Such measures include:
1.BitSight External Cyber Ratings and Risk Factors
2.Cyber Awareness Education and Training
3.Phishing Exercises and Success Rates
4.Third Party Vendor Assessment Risk levels
5.Obsolescence Level
6.Endpoint Detection and Response ("EDR") and Network
Detection and Response ("NDR") effectiveness
7.Active Directory Security Posture
8.Cloud Security Posture
9.Breach Detection effectiveness
10.Incident Response effectiveness
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] The Cybersecurity Policy and
Procedures define the core principles of security risk
management and the procedures for security management,
including the roles and responsibilities of key personnel,
strategy and measures to cope with information security
breaches and related communication procedures.
Every cybersecurity occurrence or threat that rises to a specific
level defined in the Cybersecurity Procedures is reviewed in
the various security councils set out below and communicated
to the appropriate committees as defined in the Cybersecurity
Procedures. Any such cyber incident is promptly reported by
the Group CISO to (a) the Global Ransomware Crisis
Committee and (b) the Group CFO and Disclosure Committee
for decision-making regarding external communication to
regulators or investors.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] On a quarterly basis, the Group CISO provides a cybersecurity
risk report to the Group Finance Risk Committee, headed by
the Group CFO, based on risks identified at the segment level,
which in turn reports to and assists the Board of Directors in
fulfilling its oversight responsibilities with respect to legal and
regulatory requirements, including cybersecurity. Risks
identified in the report are considered potential risks that may
affect all functions and departments across the Group.
The office of the CISO has identified the following key risk
areas:
1.Cyber attacks related to extortion, state sponsored actors,
espionage or external threats resulting in financial loss;
2.Data breaches from exfiltration of Personal Data (PII) or
Intellectual Property (IP) resulting in financial loss;
3.Cyber fraud from external or internal actors;
4.Disruption of operations resulting from cyber-related
outages;
5.Impacts on the business resulting from third party or supply
chain cyber incidents;
6.Inability to recover from or restore services in timely manner
(business resilience);
7.Inability to identify, detect or prevent spread of attacks
across the Company (defensibility);
8.Regulatory fines, penalties or lawsuits due to
misrepresentation of material incidents, poor cyber practices,
or inadequate protection or usage of artificial intelligence
(“AI”) technologies; and
9.Negative company reputation resulting from a loss of
confidence with investors and partners due to poor cyber
assessments.
As part of the risk management process, the Group’s local IT
teams, segment CIOs and segment CISOs also identify local
cyber risks and report to the Group Finance Risk Committee.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] On a quarterly basis, the Group CISO provides a cybersecurity
risk report to the Group Finance Risk Committee, headed by
the Group CFO, based on risks identified at the segment level,
which in turn reports to and assists the Board of Directors in
fulfilling its oversight responsibilities with respect to legal and
regulatory requirements, including cybersecurity.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] In fulfilling its oversight responsibilities, the Board oversees
cyber risks and incidents via the Audit & Risk Committee and
approves proposals or modifications to the Cybersecurity
Procedures. The Audit & Risk Committee relies on information
provided from Global Assurance, to which the Group CFO
provides information about risks. The Group CFO provides
information to both the Audit & Risk Committee and the Group
CEO.
Cybersecurity Risk Role of Management [Text Block] At the Group level, the Group CISO defines the global
cybersecurity strategy and roadmap.
The global cybersecurity strategy and roadmap is informed by
the ArcelorMittal Security Incident Classification and Escalation
Procedures as well as the ArcelorMittal Cyber Crisis
Management Procedures (collectively, the “Cybersecurity
Policy and Procedures”). The Cybersecurity Policy and
Procedures define the core principles of security risk
management and the procedures for security management,
including the roles and responsibilities of key personnel,
strategy and measures to cope with information security
breaches and related communication procedures.
Every cybersecurity occurrence or threat that rises to a specific
level defined in the Cybersecurity Procedures is reviewed in
the various security councils set out below and communicated
to the appropriate committees as defined in the Cybersecurity
Procedures. Any such cyber incident is promptly reported by
the Group CISO to (a) the Global Ransomware Crisis
Committee and (b) the Group CFO and Disclosure Committee
for decision-making regarding external communication to
regulators or investors.
In fulfilling its oversight responsibilities, the Board oversees
cyber risks and incidents via the Audit & Risk Committee and
approves proposals or modifications to the Cybersecurity
Procedures. The Audit & Risk Committee relies on information
provided from Global Assurance, to which the Group CFO
provides information about risks. The Group CFO provides
information to both the Audit & Risk Committee and the Group
CEO.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The following teams are organized under and report to the
Group CISO:
•the Group Chief Information Officer (“CIO”) Council (headed
by the Group CISO and made up of segment CIOs and
other specialists) leads and manages the different business
segments, which are responsible for the implementation
and management of security controls, processes and
technology within their respective business segments.
•the Group Chief Information Security (“CISO”) Council 
(headed by the Group CISO and consisting of security
officers from core segments CIOs, and Global Assurance)
is responsible for decision-making relating to all security
topics, defining roadmaps and execution of strategies and
protection within their respective segments.
•the Global Ransomware Crisis Committee made up of
various heads of leadership functions such as Legal, IT,
Treasury, Communication, Investor Relations and Global
Assurance, with the assistance of a third-party service
provider acting as the Company’s ransomware negotiator
and advising partner, is responsible for advancing and
implementing the decision-making processes in the event of
a ransomware outbreak across the Company and any
demands for ransom payments.
•the Data Protection Committee consisting of Group
Compliance, Group HR and Group CISO, and led by the
Group’s Data Privacy Officer, meets quarterly to review any
incidents or risks involving data privacy matters, and its
recommended actions are implemented across the Group.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Group CISO is an experienced
information technology and operation technology executive. He
is a leading international chief information officer with proven
expertise in cyber security, digital transformation, IT integration
and business enablement. He joined ArcelorMittal in 2024 from
a leading transportation / logistics company where he served
as their IT senior vice president and international CIO from
2017. He holds an MBA in international management from the
Thunderbird School of Global Management, Glendale, Arizona,
USA, and a Bachelor of Engineering in electronics and
communication from the National Institute of Technology,
Trichy, India.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] In fulfilling its oversight responsibilities, the Board oversees
cyber risks and incidents via the Audit & Risk Committee and
approves proposals or modifications to the Cybersecurity
Procedures. The Audit & Risk Committee relies on information
provided from Global Assurance, to which the Group CFO
provides information about risks. The Group CFO provides
information to both the Audit & Risk Committee and the Group
CEO.
The following teams are organized under and report to the
Group CISO:
•the Group Chief Information Officer (“CIO”) Council (headed
by the Group CISO and made up of segment CIOs and
other specialists) leads and manages the different business
segments, which are responsible for the implementation
and management of security controls, processes and
technology within their respective business segments.
•the Group Chief Information Security (“CISO”) Council 
(headed by the Group CISO and consisting of security
officers from core segments CIOs, and Global Assurance)
is responsible for decision-making relating to all security
topics, defining roadmaps and execution of strategies and
protection within their respective segments.
•the Global Ransomware Crisis Committee made up of
various heads of leadership functions such as Legal, IT,
Treasury, Communication, Investor Relations and Global
Assurance, with the assistance of a third-party service
provider acting as the Company’s ransomware negotiator
and advising partner, is responsible for advancing and
implementing the decision-making processes in the event of
a ransomware outbreak across the Company and any
demands for ransom payments.
•the Data Protection Committee consisting of Group
Compliance, Group HR and Group CISO, and led by the
Group’s Data Privacy Officer, meets quarterly to review any
incidents or risks involving data privacy matters, and its
recommended actions are implemented across the Group.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true