and Communications Technology (ICT) assets and services is governed by the TNB ICT Security Policy and ICT Code of Practice. The policy and code of practice ensure our employees are aware of their respective responsibilities and obligations in protecting the confidentiality, integrity, availability and authenticity of our ICT assets in the execution of day-to-day business operations. We conduct around-the-clock monitoring of cyber threats to our systems to ensure the reliability of electricity supply and to protect company data, including the personal data of our customers. We are presently accredited with globally recognised cybersecurity standards, specifically the ISO/ IEC 27001:2013 Information Security Management System for TNB’s key point installations and data centres. We also adopt IEC 62443 best practices that address cybersecurity mitigations for OT in automation and control systems.Additionally, we are certified in the Payment Card Industry Data Security Standard for payment card transactions to secure our payment gateways and mitigate potential data theft and fraud. We are vigilant in our efforts to protect the data privacy of our 10.14 million customers from unauthorised access and use. Our efforts include robust initiatives identified in our cybersecurity operating model and compliance with regulations such as the Personal Data Protection Act (PDPA) and industry standards. Securing Our Data and Network Infrastructure MANAGEMENT APPROACH SUSTAINABILITY DISCLOSURES ON MATERIAL MATTERS SUSTAINABILITY STATEMENT Sec 3 101 A cyber drill was conducted on 1 August 2023 involving 120 participants from TNB Power Generation, Grid, Distribution Network, Grid System Operator, Single Buyer, Security Services Department, ICT, Risk Management Department and Group Corporate Communication to enhance our crisis preparedness for and response to cybersecurity intrusion 1 Enhancement of cybersecurity risk assessment requirements for IT and OT systems 4 Annual assessment of TNB key point installations for cybersecurity