Mitr Phol recognizes the importance of the responsible and diligent use of data and technology. The Company has established clear data management processes and maintains readiness to respond to potential incidents. Through these practices, the Company is able to leverage data and technology effectively to enhance its competitive advantage while strengthening the trust and confidence of customers and stakeholders.
|
|
Target
|
Performance
|
|---|---|---|
|
Cybersecurity Incident Response Time
|
Within 4 hours
|
No Cybersecurity Incident
|
|
Conduct a simulated cybersecurity incident response drill
in collaboration with the operations team. |
1 time per year
|
1 time
|
|
Conduct cybersecurity incident response drills through tabletop exercises in collaboration with relevant business units.
|
1 time per year
|
1 time
|
Responsible for establishing policies and management guidelines relating to information technology, cybersecurity, and data protection, as well as supporting their implementation across all business units.
Also oversees and drives the Company's digital transformation across the organization.
Responsible for establishing the Company's risk management policies, objectives, and guidelines, including those related to information technology, cybersecurity, and data security. Supports the implementation of risk management activities, monitors and evaluates performance, and provides recommendations to ensure effective risk management practices. These efforts aim to help Mitr Phol achieve its business objectives while maximizing value for stakeholders.
Responsible for independently monitoring and reviewing the Company's operations to ensure the effectiveness of risk management and internal control systems relating to information technology, cybersecurity, and data security, as well as compliance with applicable laws, rules, and regulations.
The Audit Office serves as the internal audit function, responsible for monitoring and auditing units
involved in cybersecurity and personal data protection. The Audit Office reports directly to the Audit Committee to ensure that operations are properly and comprehensively conducted in accordance with established policies.
Responsible for defining information technology strategies in accordance with the policies established by the Digital Transformation and Cybersecurity Committee and for regularly reporting performance outcomes to the Committee. The role is held by the Executive Vice President of Digital and Technology Transformation. The CISO operates under the Digital and Technology Transformation Group, which is responsible for digital transformation, business systems development, IT infrastructure, IT security, cybersecurity, and data security to support business requirements and achieve organizational objectives.
Responsible for providing advice, reviewing operations, and supporting business units to ensure compliance with personal data protection laws. This includes establishing security measures to safeguard personal data in accordance with legal requirements and elevating personal data protection practices to internationally recognized standards.
Responsible for planning, developing, and managing technology systems, information systems, and personal data securely, with due regard for confidentiality, integrity, and availability. Also responsible for assessing and controlling risks related to information technology, cybersecurity, and data security to ensure that risk levels remain within the Company's acceptable risk appetite. In addition, responsible for monitoring, responding to, and mitigating cybersecurity and data security incidents in a timely manner to minimize potential damage, as well as promoting cybersecurity and data protection awareness among employees and relevant stakeholders.
The Company enhances the capabilities of employees at all levels and raises cybersecurity awareness through learning programs delivered through multiple channels, ensuring comprehensive and accessible learning for all employee groups. These efforts prepare employees to respond to rapidly evolving cyber threats. The following activities were implemented:
Enhancing Knowledge and Skills and Fostering a Cybersecurity Culture
Preparation for Cyber Threats
The Company develops standardized and effective processes to systematically manage cybersecurity
risks and respond to cybersecurity incidents through the following activities.
Policy Development and Review
Risk Oversight and Assessment
Incident Management
The Company deploys advanced and effective technologies to strengthen cybersecurity and protect against cyber threats through the following measures:
Through the continuous enhancement of cybersecurity practices and the promotion of a strong cybersecurity and data security culture, the Company recorded no data security breaches or incidents that adversely affected business operations or stakeholders in 2025. The Company has also established channels for reporting cybersecurity and data security concerns. All reported cases are recorded in the Incident Management System and managed in accordance with the Cybersecurity and Privacy Incident Response Procedure. Incident reports and lessons learned are documented and reviewed to continuously strengthen preventive measures and enhance the Company's ability to respond to cybersecurity and data-related threats in a timely and effective manner. Employees and external parties can report incidents, vulnerabilities, or suspicious activities related to cybersecurity and data security through the following channels.
In 2025, Mitr Phol conducted an annual Cyber Drill Simulation to assess the readiness of relevant functions in responding to cybersecurity threats. The exercise involved realistic cyber incident scenarios, with participating units following the Cybersecurity and Privacy Incident Response Procedure follow, the Company's Cybersecurity and Privacy Incident Response Procedure and Business Continuity Plan (BCP). This exercise represented an important step in strengthening organizational confidence and professional response capabilities, while fostering a strong cybersecurity culture across the organization.
|
|
Target
|
Performance
|
|---|---|---|
|
Percentage of employees from operational staff to
executive management completing Responsible AI training |
100%
|
88.31%
|
To enable employees to fully realize the benefits of AI while minimizing the risks of bias, privacy violations, and other unintended consequences, the Company provides AI training covering the ethical and secure use of AI technologies. In 2025, a total of 4,579 employees participated in AI-related training programs. In addition, the Company educates employees on the safe use of public AI websites through various internal communication channels. Warning messages are also displayed when employees access public AI websites to control employees using AI technologies appropriately. Furthermore, AI systems developed and deployed within the Company are configured to remind users that output generated by AI algorithms should be carefully reviewed and assessed. This is to ensure that AI-generated information remains subject to human review, oversight, and final decision-making. The Company also encourages employees to apply AI technologies to enhance business operations through the annual Mitr Beyond Innovation Awards. In 2025, the Digitech Champion – AI The Next Generation category was introduced to promote creative AI development and adoption across the organization.
