In connection with risk and vulnerability management, we engage third parties with cybersecurity expertise to identify, address, and mitigate cybersecurity risks. With the assistance of these third parties, we conduct penetration testing and assess existing threat actors, addressing identified vulnerabilities, within established mitigation deadlines.
We have implemented a cybersecurity management system based on our Cyber & ICT Security organizational structure (“ICT” referring to information and communication technology), as outlined below. This system involves direct oversight and reporting to our C-level Chief Information Officer (CIO), who, in turn, reports to our CEO. Our ICT risk management activities encompass processes for identifying, addressing, and assessing solutions for cybersecurity risks, monitoring the security of public telecommunications networks, data centers and business networks; managing security incidents with a focus on cyber security threat; and overseeing business continuity and crisis management efforts.
The organizational structure of our Cyber & ICT Security system is detailed below:
Our organizational structure for managing cybersecurity risks comprises the following activities and processes:
| · | Identity & ICT Risk Management: Conducts risk analysis of assets, initiatives and projects from an ICT security perspective and governs logical identities, ensuring compliance throughout the identity lifecycle. |
| · | ICT Risk Management: Evaluates initiatives, projects, products and suppliers from the perspective of ICT security architecture and associated risks. |
| · | Business Continuity & Cyber Governance: Oversees governance activities related to risk prevention processes that may affect business continuity and supports organizational functions in the implementation of security initiatives. This function also supervises the cybersecurity regulatory framework in close coordination with governance, compliance and corporate security teams. |
| · | Cyber Intelligence: Identifies emerging cyber threats and risks through continuous research, threat analysis, attack simulations and monitoring, supporting the ongoing improvement of defensive capabilities. |
| · | Advanced Cyber Defense: Measures the effectiveness and coverage of cybersecurity tools and manages continuous improvement initiatives, including the operation of perimeter defense controls such as firewalls. |
| · | Cybersecurity Operations Center (CSOC): Monitors and manages cybersecurity risks and events, including vulnerability management and the investigation and response to incidents that may affect system availability, data integrity or confidentiality and the continuity of services. |
| · | CSOC Monitoring & Response: Responsible for real-time monitoring, investigation and response to cybersecurity incidents affecting enterprise data and services. |
| · | Identity & Lawful Solutions: Ensures the effective operation of identity, access management and lawful interception solutions, supporting service continuity and compliance with legal and regulatory requirements. |
| · | Cyber Solutions & Innovation: Defines architectural standards for security solutions, evaluates and tests new cybersecurity technologies and supports the development of value-added security services in coordination with relevant business functions. |
Cybersecurity Expertise
Our Cyber & ICT Security team consists of highly qualified professionals with extensive experience in Information Security and the telecommunications sector. The Cyber & ICT Security officer and direct staff have over 20 years of expertise in information technology, corporate security, information security, and business continuity, leveraging prior experience to lead our cybersecurity initiatives and mitigate cyber risks effectively.
Compliance and Cybersecurity Frameworks
Our Cyber & ICT Security processes align with internationally recognized standards, including ISO 27001, which outlines best practices for information security management, as well as CIS8 (Internet Security Center) and NIST (Cyber security Framework), which provide controls to manage and reduce cybersecurity risk. We have established a cybersecurity policy that sets strategic risk control guidelines, defines security responsibilities and establishes requirements for employees, suppliers, and business partners, regarding the secure handling of information, including personal and sensitive data, and related ICT assets. We obtained ISO 27001 certification in 2022 and successfully completed ISO 27001 recertifications in August 2023 and September 2024.
We maintain a dedicated vulnerability management team responsible for coordinating and prioritizing actions to mitigate identified vulnerabilities. To complement this effort, we engage, external cybersecurity experts to conduct comprehensive penetration tests, assessing the effectiveness of our defenses and identifying areas for improvement. Additionally, we operate a bug bounty program, that incentivizes independent researchers and ethical hackers to report vulnerabilities in our systems, further strengthening our security posture. All identified, vulnerabilities, whether through external partners or the bug bounty program, are assessed and prioritized by our team, which develops and implements mitigation strategies for the most critical issues, ensuring the continuous protection of our ICT assets and resilience against cyber threats.
Incident Management and Regulatory Compliance
We have a structured cyber incident management process, to address security events and incidents, including those that may impact our services. This process includes evaluating and monitoring risks associated with partners and suppliers, with third-party engagement governed by contractual requirements. Additionally, we maintain reporting processes in compliance with ANATEL regulations, which are triggered based on predefined thresholds, considering the highly regulated nature of telecommunications sector.
In 2025, we did not experience any significant cybersecurity incidents that impacted our business strategy, operational results or financial condition, nor did we trigger any ANATEL reporting requirements.
Board Oversight and Strategic Cyber Risk Management
Our Board of Directors reviews cybersecurity risks annually and receives a presentation from our Cyber & ICT Security function, outlining key initiatives, risk control measures, and mitigation strategies. In 2025, the Board was presented with an overview of cybersecurity risks and monitored our progress in addressing key opportunities for improvement.