03 Risk management Risk factors specific to Michelin, description and related management systems Risk 5 – Cyber attack Risk factors Michelin's business relies on state-of-the-art information technology, systems and infrastructure (datacenters, servers, networks and cloud solutions). Like any organization using information technology, the Group is exposed to the risk of cyber attacks, which are becoming increasingly sophisticated and a source of constant danger. Recent years have seen a sharp upsurge in the number of attacks, especially ransomware and advanced persistent threat (APT) cyber-espionage attacks. Sabotage attacks and destabilizing threats are also becoming more common, generally with the goal of disrupting operations or tarnishing the Group’s image. Changing work practices, including the growing trend towards working from home, are also heightening risk exposure. The potential consequences of a cyber attack include business interruption, threats to personal safety, theft of confidential information, breaches of employee privacy, ransom demands and reputational harm. Specific nature of the risk Over the past ten years, the Group has extensively overhauled its information technology and systems, building on both legacy assets and those of the successive companies acquired. Its broad geographic footprint and highly diverse business base, product ranges and procedures all make for a complex environment, with the result that its information system has several thousand applications, a thousand or so main servers and around 100 datacenters. The Group’s exposure to digital risks is increasing, due in particular to recent acquisitions, the emerging use of connected technologies and objects by production operators, the swift migration to cloud-based solutions and bring-your-own-device practices in certain countries. Governance and risk management response The cyber attack risk factor is managed by the Data, Digital, IT Governance body, which is chaired by the Group’s General Manager, and co-chaired by the Executive Vice President of Distribution, Services & Solutions, who is a member of the Group Executive Committee. The body is led by the Group Chief Cybersecurity Officer. To deal with the above-described information technology and systems risks, multi-year action plans have been prepared with a focus on the following measures: (i) closely tracking contractual terms and conditions to be able to respond in the event of service provider default, (ii) reinforcing the physical and logical security of IT systems, (iii) systematically reviewing IT continuity needs and putting in place IT recovery plans, and (iv) replacing obsolete components and continuously upgrading information security systems. Penetration tests are very frequently conducted to confirm the security of the Group's IT solutions and data protection systems. In addition, the Group’s Computer Emergency Response Team (CERT) stands ready to intervene at all times across all continents. Lastly, training programs and awareness campaigns are regularly conducted for all Group employees and, in a more targeted manner, for the categories of employees the most exposed to this risk. The Group is striving to instill a “security by design” culture in its IT projects by addressing security issues across an application’s life cycle, from initial design to operation and end-of-life. The Group has also undertaken the process to earn Trusted Information Security Assessment Exchange (TISAX) certification, the gold standard for cybersecurity in the automotive industry, for some of its plants and product development units. By the end of 2024, 31 Michelin facilities had already been certified. TISAX certification is the final step in the process to ensure the highest level of data protection throughout the Group’s value chain. Risk 6 – Knowledge retention Risk factors One of Michelin's competitive advantages stems from the ability to sharply differentiate its products and services thanks to continuous, sustained innovation. Consequently, protecting its knowledge and expertise is a key factor in maintaining its leadership and driving its future growth. This culture of protecting knowledge and know-how is part of the Group's DNA. Specific nature of the risk Because Michelin invests heavily in innovation and the development of new growth businesses, protecting knowledge and expertise is essential to maintaining its technological leadership. Sensitive information largely concerns products, services, materials, procedures and equipment, as well as techniques, methods, design, testing and manufacturing data alongside the related databases. However, information about production, research, marketing and other business strategies, as well as consumer and supplier databases, also risk being lost or stolen. The Group is exposed to risks in its cooperation with external stakeholders, including consumers, suppliers, partners, subcontractors and academic institutions. Likewise, it is dependent on the information systems used to store and share sensitive information. In addition, Michelin must also address the growing use of social media, the development of artificial intelligence solutions and the resulting risk of information leakage. 163 2024 UNIVERSAL REGISTRATION DOCUMENT_MICHELIN
RkJQdWJsaXNoZXIy NzMxNTcx