XML 23 R7.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management, Strategy and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

ITEM 16K. CYBERSECURITY

Cybersecurity risks have grown steadily across industries and regions as technology advances in its versatility and complexity. There is a possibility of a cyberattack that could affect our operations in various ways, damage our reputation and lead to regulatory sanctions and/or financial losses.

Our strategy for managing cybersecurity risks consists of a multipronged approach, including:

Infrastructure hardening of servers, firewalls, communication equipment and cloud services.
Network segmentation, latest generation firewalls, detection and response security agents, mail filtering, USB port blocking, physical and logical access controls, disk encryption and confidential data at rest.
Solid security processes: password change controls, access controls based on least privileges, software patches and updates, secure software development framework, periodical third-party pen testing with security certifications, recertifications, pro-active management to information security incidents.
Robust business continuity strategies with daily backups, recovery testing and fire drills.
Continuous internal user awareness including training, phishing and social engineering simulation.
Comprehensive observability of infrastructure and security, and application performance monitoring.

In October 2023, we hired a dedicated Chief Information Security Officer (CISO) who is responsible for managing the Company’s cybersecurity risks. Our CISO is Mario Fernando Diaz who brings 11 years of cybersecurity experience in the financial sector (2.5 years at Santander Bank Mexico as OSI, 3 years at HSBC Mexico as Application Security Manager, 6.5 years at Nacional Monte Piedad as CISO). In addition, we have established a Committee on Information Security and Technological Risk (COSIRT) to manage our cybersecurity and any potential issues. Members of the COSIRT include our CISO, our sub-director of IT development, our infrastructure manager, our helpdesk manager, and our sub-director of IT products and projects. The COSIRT meets weekly to review, analyze, and follow up on the execution of our strategy. Monthly meetings include our Director of Information Technology. Relevant information from the COSIRT meetings is brought up by our Director of Information Technology to our CEO. Board level cybersecurity matters are brought up by the CEO to the Board in our regular Board meetings. If any material issue related to cybersecurity occurs, it triggers a special Board meeting.

Based on the information we have as of the date of this Form 20-F, we do not believe any cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

In October 2023, we hired a dedicated Chief Information Security Officer (CISO) who is responsible for managing the Company’s cybersecurity risks. Our CISO is Mario Fernando Diaz who brings 11 years of cybersecurity experience in the financial sector (2.5 years at Santander Bank Mexico as OSI, 3 years at HSBC Mexico as Application Security Manager, 6.5 years at Nacional Monte Piedad as CISO). In addition, we have established a Committee on Information Security and Technological Risk (COSIRT) to manage our cybersecurity and any potential issues. Members of the COSIRT include our CISO, our sub-director of IT development, our infrastructure manager, our helpdesk manager, and our sub-director of IT products and projects. The COSIRT meets weekly to review, analyze, and follow up on the execution of our strategy. Monthly meetings include our Director of Information Technology. Relevant information from the COSIRT meetings is brought up by our Director of Information Technology to our CEO. Board level cybersecurity matters are brought up by the CEO to the Board in our regular Board meetings. If any material issue related to cybersecurity occurs, it triggers a special Board meeting.

Based on the information we have as of the date of this Form 20-F, we do not believe any cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] In addition, we have established a Committee on Information Security and Technological Risk (COSIRT) to manage our cybersecurity and any potential issues.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The COSIRT meets weekly to review, analyze, and follow up on the execution of our strategy.
Cybersecurity Risk Role of Management [Text Block] In October 2023, we hired a dedicated Chief Information Security Officer (CISO) who is responsible for managing the Company’s cybersecurity risks. Our CISO is Mario Fernando Diaz who brings 11 years of cybersecurity experience in the financial sector (2.5 years at Santander Bank Mexico as OSI, 3 years at HSBC Mexico as Application Security Manager, 6.5 years at Nacional Monte Piedad as CISO). In addition, we have established a Committee on Information Security and Technological Risk (COSIRT) to manage our cybersecurity and any potential issues. Members of the COSIRT include our CISO, our sub-director of IT development, our infrastructure manager, our helpdesk manager, and our sub-director of IT products and projects. The COSIRT meets weekly to review, analyze, and follow up on the execution of our strategy. Monthly meetings include our Director of Information Technology. Relevant information from the COSIRT meetings is brought up by our Director of Information Technology to our CEO. Board level cybersecurity matters are brought up by the CEO to the Board in our regular Board meetings.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Members of the COSIRT include our CISO, our sub-director of IT development, our infrastructure manager, our helpdesk manager, and our sub-director of IT products and projects.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO is Mario Fernando Diaz who brings 11 years of cybersecurity experience in the financial sector (2.5 years at Santander Bank Mexico as OSI, 3 years at HSBC Mexico as Application Security Manager, 6.5 years at Nacional Monte Piedad as CISO).
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The COSIRT meets weekly to review, analyze, and follow up on the execution of our strategy. Monthly meetings include our Director of Information Technology. Relevant information from the COSIRT meetings is brought up by our Director of Information Technology to our CEO. Board level cybersecurity matters are brought up by the CEO to the Board in our regular Board meetings.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true