XML 52 R37.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy



Grupo TMM’s cybersecurity strategy is designed to ensure the confidentiality, integrity, and availability of our systems and information, facilitated by a cloud-based IT infrastructure provided by leading service providers such as Microsoft, Rackspace, and Amazon Web Services.



The processes for assessing, identifying, and managing material cybersecurity risks include continuous monitoring and threat detection by Amazon Web Services (“AWS”) and Rackspace’s 24/7 Security Operations Center tools. These tools monitor network traffic, system logs, and user activities. Our Information Technology (“IT”) team also plays a crucial role by constantly monitoring security alerts from our systems using the tools available in the security consoles of our service providers, categorizing incidents as high, medium, or low-level. In emergencies, our first-level internal IT team can halt operations if necessary.



Our incident response protocol begins by logging all incidents into Grupo TMM’s internal help desk platform, where we track their origin and severity. Primarily, we encounter attempts at penetration through malicious emails that bypass Microsoft’s security filters. Upon detection, such emails are immediately quarantined, and the sender’s domain is blacklisted. Our internal IT team also manages incident response, maintains firewalls, oversees distributed denial-of-service (“DDoS”) protection, implements Identity and Access Management (“IAM”) with Multi-Factor Authentication (“MFA”), enforces role-based access control, ensures data encryption, and provides compliance support using our service providers’ tools and personnel.



We have a contract with an external company that provides managed IT and security services. Any incident detected by TMM’s internal staff requiring a second level of attention is escalated to them. In emergencies or high-priority situations, incidents are escalated directly to AWS for ERP-related issues, to Rackspace for issues involving company operating systems or websites, and to Microsoft for Office 365 platform issues.



AWS hosts our ERP (SAP S/4 HANA) and provides network firewalls, DDoS mitigation, IAM, MFA, data encryption, monitoring and logging with AWS CloudTrail, compliance support, vulnerability management, advanced threat detection, and daily backups. Regular vulnerability scans inform Grupo TMM’s IT team promptly of critical vulnerabilities.



Our organizational communication is based on the Microsoft 365 platform, incorporating cybersecurity features like Advanced Threat Protection (ATP), email encryption, Data Loss Prevention (DLP), and Multi-Factor Authentication (MFA). Rackspace hosts specific applications and websites for Grupo TMM companies, offering continuous security monitoring, incident response, managed firewalls, DDoS protection, IAM with MFA, role-based access control, data encryption, daily backups, and compliance support.



Collaboration with our service providers offers significant benefits in security, cost efficiency, scalability, and compliance. Leveraging their expertise and offerings is crucial for our comprehensive cybersecurity and risk management strategy.



AWS and Rackspace provide extensive risk management frameworks, including continuous monitoring, threat intelligence, and automated responses to security incidents, enhancing our proactive risk management capabilities. Outsourcing security to AWS and Rackspace allows us to focus on core business activities while benefiting from their security expertise in protecting our data and systems.



We have access to state-of-the-art security tools and technologies continually updated to address the latest cyber threats. AWS offers services like AWS Shield for DDoS protection, AWS Identity and Access Management (IAM), and AWS GuardDuty for continuous threat detection and monitoring. Rackspace provides managed security services, including a 24/7 Security Operations Center, incident response, and vulnerability management. Both AWS and Rackspace support compliance with major global regulatory standards such as the General Data Protection Regulation (“GDPR”), the Health Insurance Portability and Accountability Act (“HIPAA”), the Payment Card Industry Data Security Standard (“PCI-DSS”), and the International Organization for Standardization (“ISO”) 27001.



Scalable solutions allow us to adjust resources according to demand, ensuring efficient security measures without compromising protection. Using AWS and Rackspace cloud services, we achieve significant cost savings through economies of scale, avoiding high costs associated with maintaining on-premises infrastructure.



Advanced data backup and disaster recovery solutions ensure business continuity in cyber incidents. AWS’s data protection services and Rackspace’s daily data backups minimize downtime and data loss in disasters. AWS and Rackspace conduct automated security assessments and advanced threat detection to promptly address vulnerabilities in our hosted services.



Our strategy not only safeguards IT operations but also enhances protection against evolving cyber threats. Regular employee training and awareness programs, with ongoing communication and training for all employees, are crucial for maintaining cybersecurity. We believe our employees are our first line of defense against potential vulnerabilities.



As of today, we are pleased to report that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition. Minor incidents, primarily involving the reception of malicious emails bypassing Microsoft’s filters, have occurred. In many cases, user actions did not jeopardize our systems. Ongoing communication and training efforts ensure employees remain informed and vigilant against cyber threats.



By leveraging AWS and Rackspace cybersecurity services, Grupo TMM integrates advanced threat detection, vulnerability management, compliance support, incident response capabilities, and expert guidance into our risk management framework. This integration enhances our ability to proactively assess, identify, and manage material cybersecurity risks, effectively safeguarding our systems, data, and operations.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

The processes for assessing, identifying, and managing material cybersecurity risks include continuous monitoring and threat detection by Amazon Web Services (“AWS”) and Rackspace’s 24/7 Security Operations Center tools. These tools monitor network traffic, system logs, and user activities. Our Information Technology (“IT”) team also plays a crucial role by constantly monitoring security alerts from our systems using the tools available in the security consoles of our service providers, categorizing incidents as high, medium, or low-level. In emergencies, our first-level internal IT team can halt operations if necessary.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

As of today, we are pleased to report that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition. Minor incidents, primarily involving the reception of malicious emails bypassing Microsoft’s filters, have occurred. In many cases, user actions did not jeopardize our systems. Ongoing communication and training efforts ensure employees remain informed and vigilant against cyber threats.
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance



At Grupo TMM, our Chief Information Officer (“CIO”) leads our cybersecurity strategy, aligning it with industry best practices. We do not have a specific board committee or subcommittee overseeing cybersecurity risks.



The CIO, along with our cloud-service providers and IT team, oversees the integration of advanced threat detection systems, multi-factor authentication, and data encryption protocols with our providers. This compliance with global regulatory standards like GDPR, HIPAA, PCI-DSS, and industry standards like ISO 27001, SOC 1, and SOC 2 is crucial.



Our CIO has extensive experience leading technology, communications, and cybersecurity teams. Notably, he developed the perimeter security strategy for Mexico’s state-owned electric utility company, Comisión Federal de Electricidad (“CFE”), while serving as CIO from 2013 to 2016. Subsequently, he safeguarded CFEnergía and CFE International trading systems from cyber threats. Collaborating with our cloud service providers ensures Grupo TMM benefits from cutting-edge security technologies and practices.



Our IT team notifies the CIO of cybersecurity threats to Grupo TMM’s systems. High-priority incidents prompt the CIO to report to our Chief Executive Officer, Chief Financial Officer, and Board of Directors during quarterly meetings. We proactively aim to prevent incidents in Grupo TMM’s systems by observing and learning from incidents in other companies.



Internally, regular employee training, incident response planning, and continuous cybersecurity risk monitoring foster a robust security culture. This direction not only protects cloud data but also strengthens trust and confidence among employees and stakeholders.



The availability of up-to-date information and ongoing employee training are fundamental pillars in maintaining secure and sustainable operations. The combination of effective governance, the strategic leadership of the CIO, and the support of industry-leading technology providers allows Grupo TMM to maintain a robust cybersecurity posture, effectively protecting its systems, data, and operational infrastructure.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

At Grupo TMM, our Chief Information Officer (“CIO”) leads our cybersecurity strategy, aligning it with industry best practices. We do not have a specific board committee or subcommittee overseeing cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our IT team notifies the CIO of cybersecurity threats to Grupo TMM’s systems. High-priority incidents prompt the CIO to report to our Chief Executive Officer, Chief Financial Officer, and Board of Directors during quarterly meetings.
Cybersecurity Risk Role of Management [Text Block]

At Grupo TMM, our Chief Information Officer (“CIO”) leads our cybersecurity strategy, aligning it with industry best practices. We do not have a specific board committee or subcommittee overseeing cybersecurity risks.



The CIO, along with our cloud-service providers and IT team, oversees the integration of advanced threat detection systems, multi-factor authentication, and data encryption protocols with our providers. This compliance with global regulatory standards like GDPR, HIPAA, PCI-DSS, and industry standards like ISO 27001, SOC 1, and SOC 2 is crucial.



Our CIO has extensive experience leading technology, communications, and cybersecurity teams. Notably, he developed the perimeter security strategy for Mexico’s state-owned electric utility company, Comisión Federal de Electricidad (“CFE”), while serving as CIO from 2013 to 2016. Subsequently, he safeguarded CFEnergía and CFE International trading systems from cyber threats. Collaborating with our cloud service providers ensures Grupo TMM benefits from cutting-edge security technologies and practices.



Our IT team notifies the CIO of cybersecurity threats to Grupo TMM’s systems. High-priority incidents prompt the CIO to report to our Chief Executive Officer, Chief Financial Officer, and Board of Directors during quarterly meetings. We proactively aim to prevent incidents in Grupo TMM’s systems by observing and learning from incidents in other companies.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

At Grupo TMM, our Chief Information Officer (“CIO”) leads our cybersecurity strategy, aligning it with industry best practices. We do not have a specific board committee or subcommittee overseeing cybersecurity risks.



The CIO, along with our cloud-service providers and IT team, oversees the integration of advanced threat detection systems, multi-factor authentication, and data encryption protocols with our providers. This compliance with global regulatory standards like GDPR, HIPAA, PCI-DSS, and industry standards like ISO 27001, SOC 1, and SOC 2 is crucial.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
Our CIO has extensive experience leading technology, communications, and cybersecurity teams. Notably, he developed the perimeter security strategy for Mexico’s state-owned electric utility company, Comisión Federal de Electricidad (“CFE”), while serving as CIO from 2013 to 2016.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Our IT team notifies the CIO of cybersecurity threats to Grupo TMM’s systems. High-priority incidents prompt the CIO to report to our Chief Executive Officer, Chief Financial Officer, and Board of Directors during quarterly meetings. We proactively aim to prevent incidents in Grupo TMM’s systems by observing and learning from incidents in other companies.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true