v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Unilever recognises the importance of cyber security and takes a risk-based
approach to the defence and resiliency of critical assets, business operations,
technology and data:
■Unilever has an established Cyber Security Risk Management Framework
aligned to industry-standard methodologies and control frameworks. We
promote a company-wide culture of cyber security awareness and vigilance
and provide regular reporting on the cyber security risk posture of the
organisation to operational and business leaders, leadership executives and
key non-executives, in order to influence and promote continuous
improvement of our risk posture. Unilever’s Cyber Security Risk Management
processes are integrated into its broader enterprise-level risk management
framework and its associated reporting and monitoring, with cyber security risk
forming a central part of the principal risk ’Information and Cyber Security’
on page 35;
■Unilever has an established framework of Cyber Security Policies and
Standards which are in alignment to the National Institute of Standards and
Technology Cyber Security Framework (NIST CSF). These apply
to employees, third parties, contractors, data and technology across Unilever.
Unilever Cyber Security Policies and Standards are subject to periodic review
and modifications based on any changes in risk;
■A Cyber Security Assurance team dedicated to risk assurance, and
the Internal Audit team conduct independent enterprise-wide risk reassurance,
and assess and report on the risk posture of our key systems, services, data
and operations. The scope and frequency of the evaluations are risk-based,
with output used to influence and promote continuous improvement of
Unilever’s resilience posture, as well as provide insights to the governance of
cyber risk by the Audit Committee. The Cyber Security Assurance team is
composed of internal and external expertise (e.g. third-party assessors and
consultants), including penetration testing services and a bug bounty
programme;
■Unilever requires prioritised third parties and contractors to complete initial
and periodic security assessments, with a dedicated team that monitors and
assesses risks associated with such service providers and contractors;
■Unilever’s Cyber Security team drives continuous improvement initiatives
across all NIST CSF functions, leveraging people, processes and technology
to address emerging risks. This includes the use of threat intelligence to
continually adapt to changes in threat actor tactics, techniques and
procedures and a significant focus on human risk aspects. We also conduct
resilience planning and recovery testing, aiming to bolster preparedness for
cyber security incidents; and
■While Unilever’s cyber risk management activities are aimed at reducing the
likelihood of a material cyber security incident happening, they cannot
guarantee a material event will not occur. Should a material event occur,
Unilever has a set of established and rehearsed incident response
procedures. These set out a structured, phased, tiered response for the full
incident lifecycle, including coordination with other corporate functions and
relevant senior leaders (see below). Our procedures are designed to detect
and respond in a timely manner to abnormal cyber activity in order to minimise
business impact – for example, by supporting rapid recovery of services and/
or operations, enabling legal and regulatory obligations, or reducing
reputational impact.
Our internal Cyber Security function is a global team of experienced
professionals, with a multi-channelled talent pipeline, who carry various and
multiple industry credentials, led by our Chief Information Security Officer (CISO).
Our internal team is complemented by the expertise and specialised knowledge
of a range of external partners and providers. These external providers add
support across select capabilities, all in alignment with cyber security industry
good practice frameworks.
Material cyber security risks, threats and incidents
Unilever has experienced and continues to experience cyber-attacks regularly.
However, during the year ended 31 December 2025, no known cyber security
incidents have materially affected or are reasonably likely to materially affect
Unilever.
Governance
Board Oversight
The Board of Directors oversees cyber security risk as part of its overall risk
management framework, with specific oversight provided by the Audit
Committee.
Management, primarily the Chief Digital & Technology Officer (CDTO) and the
CISO, provide cyber security briefings to the Audit Committee on a regular
(typically quarterly) basis, covering a range of topics including:
■status of ongoing cyber security controls and risk posture, and continuous
improvement initiatives;
■operational metrics, and reports and learnings, as applicable, from any cyber
security events;
■cyber security risk management frameworks, and regulatory trends and
requirements; and
■ongoing awareness of external threat landscape and trends.
The Audit Committee’s role in cyber security risk oversight is further supported by
our Internal Audit function which provides independent
re-assurance of the effectiveness of Management’s cyber security risk handling
including internal controls systems.
Management Role in Cyber Security Risk Management
Ownership of cyber security risk at Unilever sits with the Chief Supply Chain and
Operations Officer (CSCOO), who is a member of Unilever’s executive
leadership team. He receives regular, routine cyber security briefings as well as
ad hoc updates as needed. The broader executive leadership team members are
informed of the cyber security risk posture of Unilever and participate in periodic
education and awareness sessions.
The CDTO and CISO report into the CSCOO, and are responsible for managing
and assessing Unilever’s cyber security risk. The CISO was recently promoted to
the role of CDTO, and succession plans for the CISO role will be announced in
due course. The CDTO has over 20 years of executive-level experience in
information technology and cyber security, through leadership roles in various
companies. Her background includes: strategy- and architecture-focused roles;
technical experience; and expertise in material cyber incident response.
Outputs from the cyber security risk management process, threat detection
capability, vulnerability lifecycle management, and assurance and re-assurance
activities drive enterprise-wide visibility and reporting of company performance
on cyber security risk posture, influencing and prioritising continuous risk
mitigation activities across the enterprise.
To make transparent and track the continuous risk mitigation activities across the
enterprise, a council of senior individuals and executives meets regularly and
forms the membership of the Information Protection Council (IPC). This Council
(jointly chaired by the CISO and Chief Privacy Officer) has expertise in cyber
security, information technology, enterprise risk, privacy, legal, physical security
and internal audit. The IPC actively reviews enterprise-wide cyber security risk
management prioritisation, progress and initiatives, providing key operational
unlocks and risk prioritisation decisions. These senior individuals have significant
experience and expertise across multiple industries, with special expertise in
developing and executing cyber security strategy, driving digital transformation,
managing information technology, overseeing and embedding data protection and
data privacy good practices, the embedding and oversight of financial controls, and
operating within complex regulatory and compliance environments. The members
of the IPC then drive, as appropriate to their role and responsibilities, first and
second line of defence risk reduction activities, providing a whole-of-Unilever
approach to the governance of cyber security risk, the embedding of cyber security
controls, assurance of those controls and risk posture, and independent re-
assurance of our cyber security risk posture.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Unilever has an established Cyber Security Risk Management Framework
aligned to industry-standard methodologies and control frameworks. We
promote a company-wide culture of cyber security awareness and vigilance
and provide regular reporting on the cyber security risk posture of the
organisation to operational and business leaders, leadership executives and
key non-executives, in order to influence and promote continuous
improvement of our risk posture. Unilever’s Cyber Security Risk Management
processes are integrated into its broader enterprise-level risk management
framework and its associated reporting and monitoring, with cyber security risk
forming a central part of the principal risk ’Information and Cyber Security’
on page 35;
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board of Directors oversees cyber security risk as part of its overall risk
management framework, with specific oversight provided by the Audit
Committee.
Management, primarily the Chief Digital & Technology Officer (CDTO) and the
CISO, provide cyber security briefings to the Audit Committee on a regular
(typically quarterly) basis, covering a range of topics including:
■status of ongoing cyber security controls and risk posture, and continuous
improvement initiatives;
■operational metrics, and reports and learnings, as applicable, from any cyber
security events;
■cyber security risk management frameworks, and regulatory trends and
requirements; and
■ongoing awareness of external threat landscape and trends.
The Audit Committee’s role in cyber security risk oversight is further supported by
our Internal Audit function which provides independent
re-assurance of the effectiveness of Management’s cyber security risk handling
including internal controls systems.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board of Directors oversees cyber security risk as part of its overall risk
management framework, with specific oversight provided by the Audit
Committee.
Management, primarily the Chief Digital & Technology Officer (CDTO) and the
CISO, provide cyber security briefings to the Audit Committee on a regular
(typically quarterly) basis, covering a range of topics including:
■status of ongoing cyber security controls and risk posture, and continuous
improvement initiatives;
■operational metrics, and reports and learnings, as applicable, from any cyber
security events;
■cyber security risk management frameworks, and regulatory trends and
requirements; and
■ongoing awareness of external threat landscape and trends.
The Audit Committee’s role in cyber security risk oversight is further supported by
our Internal Audit function which provides independent
re-assurance of the effectiveness of Management’s cyber security risk handling
including internal controls systems.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Management, primarily the Chief Digital & Technology Officer (CDTO) and the
CISO, provide cyber security briefings to the Audit Committee on a regular
(typically quarterly) basis, covering a range of topics including:
■status of ongoing cyber security controls and risk posture, and continuous
improvement initiatives;
■operational metrics, and reports and learnings, as applicable, from any cyber
security events;
■cyber security risk management frameworks, and regulatory trends and
requirements; and
■ongoing awareness of external threat landscape and trends.
Cybersecurity Risk Role of Management [Text Block] Ownership of cyber security risk at Unilever sits with the Chief Supply Chain and
Operations Officer (CSCOO), who is a member of Unilever’s executive
leadership team. He receives regular, routine cyber security briefings as well as
ad hoc updates as needed. The broader executive leadership team members are
informed of the cyber security risk posture of Unilever and participate in periodic
education and awareness sessions.
The CDTO and CISO report into the CSCOO, and are responsible for managing
and assessing Unilever’s cyber security risk. The CISO was recently promoted to
the role of CDTO, and succession plans for the CISO role will be announced in
due course. The CDTO has over 20 years of executive-level experience in
information technology and cyber security, through leadership roles in various
companies. Her background includes: strategy- and architecture-focused roles;
technical experience; and expertise in material cyber incident response.
Outputs from the cyber security risk management process, threat detection
capability, vulnerability lifecycle management, and assurance and re-assurance
activities drive enterprise-wide visibility and reporting of company performance
on cyber security risk posture, influencing and prioritising continuous risk
mitigation activities across the enterprise.
To make transparent and track the continuous risk mitigation activities across the
enterprise, a council of senior individuals and executives meets regularly and
forms the membership of the Information Protection Council (IPC). This Council
(jointly chaired by the CISO and Chief Privacy Officer) has expertise in cyber
security, information technology, enterprise risk, privacy, legal, physical security
and internal audit. The IPC actively reviews enterprise-wide cyber security risk
management prioritisation, progress and initiatives, providing key operational
unlocks and risk prioritisation decisions. These senior individuals have significant
experience and expertise across multiple industries, with special expertise in
developing and executing cyber security strategy, driving digital transformation,
managing information technology, overseeing and embedding data protection and
data privacy good practices, the embedding and oversight of financial controls, and
operating within complex regulatory and compliance environments. The members
of the IPC then drive, as appropriate to their role and responsibilities, first and
second line of defence risk reduction activities, providing a whole-of-Unilever
approach to the governance of cyber security risk, the embedding of cyber security
controls, assurance of those controls and risk posture, and independent re-
assurance of our cyber security risk posture.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CDTO and CISO report into the CSCOO, and are responsible for managing
and assessing Unilever’s cyber security risk. The CISO was recently promoted to
the role of CDTO, and succession plans for the CISO role will be announced in
due course. The CDTO has over 20 years of executive-level experience in
information technology and cyber security, through leadership roles in various
companies. Her background includes: strategy- and architecture-focused roles;
technical experience; and expertise in material cyber incident response.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CDTO and CISO report into the CSCOO, and are responsible for managing
and assessing Unilever’s cyber security risk. The CISO was recently promoted to
the role of CDTO, and succession plans for the CISO role will be announced in
due course. The CDTO has over 20 years of executive-level experience in
information technology and cyber security, through leadership roles in various
companies. Her background includes: strategy- and architecture-focused roles;
technical experience; and expertise in material cyber incident response.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Ownership of cyber security risk at Unilever sits with the Chief Supply Chain and
Operations Officer (CSCOO), who is a member of Unilever’s executive
leadership team. He receives regular, routine cyber security briefings as well as
ad hoc updates as needed. The broader executive leadership team members are
informed of the cyber security risk posture of Unilever and participate in periodic
education and awareness sessions.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true