OSRAM LICHT AG ANNUAL

Risk Management

Risk Management Cyber & Data Security Risk In the scope of its global activities, the ams Group significant risks at an early stage so that appropri- Due to the advancing digitalization as well as in place, which is responsible for data security in- is exposed to a variety of risks that are inseparably ate measures can be taken. increasing home office activities of employees, quiries and data security improvements for the ams linked to business activities. ams has developed the risk in terms of cyber and data protection has sites worldwide and, among other things, prepares and implemented effective internal risk control Internal auditing complements the risk manage- increased continually in recent years. To counter mandatory data protection trainings for employees. systems for timely identification, assessment ment process. In close cooperation with the Audit these risks, ams has appointed both a CISO (Corpo- The Data Protection Board consists of representa- and countermeasures. These risk control systems Committee of the Supervisory Board, it pursues the rate Information Security Officer) and a DPO (Data tives from several departments. The manage ment were implemented together with the company’s goal of analyzing internal processes and suggest- Protection Officer). The Board of Directors receives of the various active security solutions (including external consultants and are based on best practice ing improvements where necessary. regular updates from the CISO and DPO on key firewalls, anti-virus, SIEM, cloud proxy) is provided examples. As part of the internal risk management issues and progress. In the area of information by an external IT partner that is ISO27001 certified. process, risks are continuously monitored and The risk management of OSRAM in conducted security (information security + cybersecurity), ams In addition, ams is regularly audited by customers evaluated by the operating units and regularly re- independently by its management. Information follows the ISO27001 standard. In the area of data in the area of cyber & data security. ported to the Management Board and Supervisory on this can be found in the management report of security, an independent Data Protection Board is Board in a risk report. This ensures identification of OSRAM. Financial Risks Operational Risk Risk management is conducted by the central in connection with the acquisi