XML 72 R47.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

GeoPark prioritizes cybersecurity risk management as an integral part of our overall enterprise risk management model. Our cybersecurity risk management practices provide a framework for handling cybersecurity threats and incidents and facilitating coordination across our different departments.

Beginning in 2022, we successfully implemented the NIST framework and established a 24/7 Security Operations Center, reinforcing our commitment to cybersecurity. This framework includes: the following measures: (i) the inventory and prioritization of each of the assets connected to the GeoPark network, (ii) the implementation and assessment of the effectiveness of the necessary controls to protect such assets against cyber threats, (iii) inventory of the most critical information and monitoring through the use of data loss prevention tool, (iv) the 24/7 monitoring of cyber threats and the status of the relevant assets, (v) the implementation and testing of processes for the mitigation and/or containment of cyberattacks, (vi) cyber-incident management process, and (vii) a recovery plan, should a cyberattack materialize, that minimizes the impact of such cyberattack on the operations of the company.

Under the NIST framework, we address possible cybersecurity threats associated with third-party service providers by identifying the dependence of our operations on third-party service providers. We have established cybersecurity requirements for the provision of services and/or the integration of infrastructures, which are included in the corresponding contractual documentation with third-party service providers. Additionally, we require our third-party service providers to deliver periodic information on compliance with said requirements.

In 2024, we reinforced our defenses against cyber threats by enhancing our cybersecurity capabilities with the onboarding of new roles to the cybersecurity team, implementing measurement and improvement processes, and conducting a third-party assessment of our cybersecurity strategy and framework. We design and implement a cybersecurity course for employees and third parties. Additionally, we optimize our platforms using industry-leading protection systems, such as Crowd Strike, Palo Alto firewalls, Multifactor Authentication, Microsoft Defense, Darktrace, Patch Automation Software, Umbrella, and SDWAN. To strengthen our technology infrastructure and enhance data protection practices, we developed a site recovery solution for critical applications, involving redundant systems in different geographical locations and intercloud backups across multiple service providers.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

GeoPark prioritizes cybersecurity risk management as an integral part of our overall enterprise risk management model. Our cybersecurity risk management practices provide a framework for handling cybersecurity threats and incidents and facilitating coordination across our different departments.

Beginning in 2022, we successfully implemented the NIST framework and established a 24/7 Security Operations Center, reinforcing our commitment to cybersecurity. This framework includes: the following measures: (i) the inventory and prioritization of each of the assets connected to the GeoPark network, (ii) the implementation and assessment of the effectiveness of the necessary controls to protect such assets against cyber threats, (iii) inventory of the most critical information and monitoring through the use of data loss prevention tool, (iv) the 24/7 monitoring of cyber threats and the status of the relevant assets, (v) the implementation and testing of processes for the mitigation and/or containment of cyberattacks, (vi) cyber-incident management process, and (vii) a recovery plan, should a cyberattack materialize, that minimizes the impact of such cyberattack on the operations of the company.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our board of directors has overall oversight responsibility for our risk management and delegates cybersecurity risk management oversight to the Audit Committee. In this capacity, the Audit Committee reviews and reports to the full board regarding cybersecurity risks and plans to ensure management has processes in place to identify, evaluate and mitigate cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Audit Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our IT Director and Cybersecurity and Compliance Manager regularly update the Audit Committee on the company’s cybersecurity programs, risks, and mitigation strategies.
Cybersecurity Risk Role of Management [Text Block]

engineering, a specialization in telecommunications, and a master’s degree in project management, he has successfully designed and executed enterprise-wide cybersecurity strategies that protect critical infrastructure and ensure regulatory compliance. He has implemented global cybersecurity frameworks, including NIST and C2M2, strengthening the organization's security posture and aligning risk management with business objectives. His contributions extend to the World Economic Forum (WEF), where he actively engages in shaping global cybersecurity strategies. With deep expertise in governance, risk management, and compliance (GRC), he leads proactive risk mitigation initiatives, fortifying the organization’s defense against emerging threats while fostering a resilient cybersecurity culture across all operational levels.

In the event a cyberattack materializes, our cyber-incident management process is triggered and an interdisciplinary committee (which includes our IT Director, our Cybersecurity and Compliance Manager and the cybersecurity team) is convened. The interdisciplinary committee is charged with containing the cyberattack in the shortest possible time with the minimum possible impact to our operations. This process has an escalation matrix where, depending on the infrastructure and information compromised, management of the incident is scaled to specific roles in the company. Any material incidents are required to be reported by our IT Director and our Cybersecurity and Compliance Manager to the Audit Committee and the board of directors.

As part of our risk management process, we seek to determine if there are any risks that have not been identified or that have not been properly assessed. Accordingly, our IT team and the Cybersecurity and Compliance Manager conduct annual reviews that inventory, evaluate, and assess cybersecurity risks, including those related to third-party service providers, at both the information and operational infrastructure level. With the goal of having an independent judgment, we complement the internal annual review with the engagement of a third-party cybersecurity expert, with relevant expertise in these kind of methodologies, risk evaluations and mitigation plans design, who conducts ethical hacking exercises to test: (i) from an external viewpoint, the paths that an attacker could use to try to compromise our infrastructure and information by simulating the activity of an attacker using sophisticated tools and expertise, and (ii) from an internal viewpoint, our security operation center’s capability to detect and contain such simulated attack.

Following the annual review described above, mitigation plans are generated by the Cybersecurity and Compliance Manager and approved by the IT director to remove any identified risks or bring them to acceptable levels. Once approved, the IT Director and the Cybersecurity and Compliance Manager present the mitigation plans to the Audit Committee. Furthermore, we also engage a third-party cybersecurity expert for purposes of conducting an annual audit which seeks to assess and evaluate the effectiveness of cybersecurity controls currently in place. The results of the annual audit are shared with our Audit Committee.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] IT Director with the support of our Cybersecurity and Compliance Manager
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our IT Director is a systems engineer, who holds a master’s degree in systems and computing engineering with an emphasis on analytics and artificial intelligence and a master’s degree in business administration. She has worked for over 16 years in IT positions leading high-impact teams in the adoption of technologies that enhance the strategy and results of organizations. Prior to joining GeoPark, she held positions such as Regional Director at Microsoft in Colombia and Chief Information Officer for Andes University in Colombia. Our Cybersecurity and Compliance Manager brings over 20 years of expertise in cybersecurity, digital transformation, and technology risk management within the oil & gas sector and multinational corporations. With a degree in systems engineering, a specialization in telecommunications, and a master’s degree in project management, he has successfully designed and executed enterprise-wide cybersecurity strategies that protect critical infrastructure and ensure regulatory compliance. He has implemented global cybersecurity frameworks, including NIST and C2M2, strengthening the organization's security posture and aligning risk management with business objectives. His contributions extend to the World Economic Forum (WEF), where he actively engages in shaping global cybersecurity strategies. With deep expertise in governance, risk management, and compliance (GRC), he leads proactive risk mitigation initiatives, fortifying the organization’s defense against emerging threats while fostering a resilient cybersecurity culture across all operational levels.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] In the event a cyberattack materializes, our cyber-incident management process is triggered and an interdisciplinary committee (which includes our IT Director, our Cybersecurity and Compliance Manager and the cybersecurity team) is convened. The interdisciplinary committee is charged with containing the cyberattack in the shortest possible time with the minimum possible impact to our operations. This process has an escalation matrix where, depending on the infrastructure and information compromised, management of the incident is scaled to specific roles in the company.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true