Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | We maintain a comprehensive process to assess, identify, and manage risks arising from vulnerabilities, including risks related to disruptions to business operations or financial reporting systems, intellectual property theft, fraud, extortion, harm to employees or customers, privacy law violations, and other legal disputes and risks, as part of our overall risk management system and processes. Our information security and cybersecurity risk management processes include the following: •Our processes are structured based on NIST Cybersecurity and ISO 27001 frameworks. Our processes and policies are periodically reviewed to cover relevant risks. •We utilize components in our information security and cybersecurity framework such as multi-factor authentication, firewalls, antivirus software, vulnerability and penetration testing, among others. •Additionally, our internal areas collaborate with each other, encompassing those responsible for day-to-day Information Security and Cybersecurity matters, including our Cybersecurity team, Legal, Audit, Human Resources, and Corporate. •We frequently conduct training and awareness campaigns on information security and cybersecurity so that everyone receives guidance and can identify and report information security events or incidents, both in the corporate and industrial environments. These actions are intended to promote familiarity with our Information Security Policy. We also leverage internal communications to raise awareness and conduct phishing simulation exercises. •We regularly review, test, and update our information security and cybersecurity processes by conducting penetration testing, vulnerability assessments, and attack simulations. Measures are implemented to deter, prevent, detect, and respond to unauthorized activities in our systems. We annually conduct assessments of cybersecurity controls through independent consulting firms, which contribute to the evolution of the maturity on the subject. The results of these assessments are shared with the executive leadership, and relevant points are addressed throughout the year. Our information security risk management aims to identify, analyze, evaluate, and treat all of our information security risks, as a continuous and measurable process. Relevant information security risks are treated so that they are mitigated, avoided, or accepted. When mitigating, we seek to reduce the likelihood of damage to our assets and business impact whenever possible. Information security risks are periodically reported to the Cybersecurity Management, for the responsible Head, and our Senior Management. Furthermore, relevant information security incidents are also reported to the same responsible parties and, when applicable, to the Competent Authorities within the established deadline. Our business strategy, operational results, and financial situation have not been materially affected by information security risk or incident, including previous information security incidents. We cannot provide assurance that they will not be affected in the future by such risks and any future incidents.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | We frequently conduct training and awareness campaigns on information security and cybersecurity so that everyone receives guidance and can identify and report information security events or incidents, both in the corporate and industrial environments. These actions are intended to promote familiarity with our Information Security Policy. We also leverage internal communications to raise awareness and conduct phishing simulation exercises. •We regularly review, test, and update our information security and cybersecurity processes by conducting penetration testing, vulnerability assessments, and attack simulations. Measures are implemented to deter, prevent, detect, and respond to unauthorized activities in our systems.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | There is monitoring and reporting to the company's Audit team and Corporate Risk team, where Cybersecurity is also overseen by the Board on their respective agendas. |
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Cybersecurity is periodically on the agenda of our Board of Directors, in addition to specific Cyber Committees within the company alongside executives. There is monitoring and reporting to the company's Audit team and Corporate Risk team, where Cybersecurity is also overseen by the Board on their respective agendas.
|
| Cybersecurity Risk Role of Management [Text Block] | Head of Technology The Head of Technology is primarily responsible for overseeing cybersecurity threat-related risks through the specific Cybersecurity management, and always connects with corporate risks. The Head of Technology has 30 years of experience in information technology, business management, operations and logistics acquired through the leadership of projects and in different types of industries such as consumer goods, electronics, metallurgy, steelmaking, and petrochemicals during 16 years of consulting, and 14 years at a global mining company. At Suzano, she leads a robust Information Technology team, where one of the managements is responsible for Cybersecurity. In the position of Cybersecurity Manager, we have a leader with expertise in the subject and over 18 years of experience in Cybersecurity. To fulfill this responsibility, it is equipped with information from established information security processes and controls, periodically reporting strategic indicators to the security committee, and to the audit and executive committees as requested. Management We have an internally formalized process, based on the ISO 27005 framework, that defines the management of cybersecurity risks, aiming to identify, monitor, and communicate information security risks that may impact the business through a systematic approach and a continuous process, monitoring and, whenever possible, reducing the likelihood of causing any type of damage to our assets. Risks are periodically reported to management, as well as relevant information security incidents. Board Cybersecurity is periodically on the agenda of our Board of Directors, in addition to specific Cyber Committees within the company alongside executives. There is monitoring and reporting to the company's Audit team and Corporate Risk team, where Cybersecurity is also overseen by the Board on their respective agendas.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | At Suzano, she leads a robust Information Technology team, where one of the managements is responsible for Cybersecurity. In the position of Cybersecurity Manager, we have a leader with expertise in the subject and over 18 years of experience in Cybersecurity.
|
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | we have a leader with expertise in the subject and over 18 years of experience in Cybersecurity. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | To fulfill this responsibility, it is equipped with information from established information security processes and controls, periodically reporting strategic indicators to the security committee, and to the audit and executive committees as requested.
|
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |