Cyber Security and Privacy Protection

Governance Structure

B.Grimm Power has established a dedicated Digital and Cyber Security Governance Body as follows;

• The Digital Transformation Committee is established as a sub-committee of the Board of Directors of B.Grimm Power. The committee shall ensure that digital initiatives align with organisation’s strategic goals and long-term vision. It provides guidance, oversight, and evaluation of digital strategies to enhance operational efficiency, innovation, sustainability, and competitiveness, while also ensuring that cybersecurity, data privacy, and digital risk management are effectively addressed across the organisation. The committee reports annually to the Board of Directors annually.
• The Co-Heads of B.Grimm Digital and Energy Solutions division, reporting directly to the Co-President – Thailand Business and Energy & Industrial Solution Business, are responsible for overseeing the digital landscape and ensuring alignment between information policies and security measures. To safeguard the organisation's digital assets, they develop and implement robust cyber security strategies, conduct regular assessments, and establish comprehensive guidelines. By managing IT infrastructure and driving digital transformation, the Co-Heads also contribute to operational efficiency and employee empowerment. The division reports to the Digital Transformation Committee annually.

There are 5 key departments within the B.Grimm Digital division

1. Digital Governance: Ensures that information management aligns with organisational goals and security standards.

2. Cyber Security: Protects digital assets by preventing, detecting, and responding to cyber threats. This department consists of 3 main teams:

• Security Operation Center (SOC) Team: Monitors, detects, investigates, and responds to cyber security threats in real-time.
• Blue Team: Focuses on defending the organisation by identifying vulnerabilities, hardening defenses, and ensuring systems are secure.
• Red Team: Simulates attacks to identify vulnerabilities and test the effectiveness of the organisation’s security measures.

3. Digital Transformation: Leverages technology to improve business processes and efficiency.

4. Digital Operations: Manages IT infrastructure and systems, providing technical support to employees.

5. Digital Technology: Researches and implements new technologies to drive innovation and business growth.

Strategy

B.Grimm Power adheres to the highest security standards. Our policies, procedures, information technology infrastructure and operational framework comply with applicable laws, regulations and international standards, such as the cyber security management framework of the U.S. National Institute of Standards and Technology (NIST) and Information Security Management System (ISO/IEC 2700:2022). We continuously monitor and respond to cyber threats 24/7 via our Cyber Security Operations Center (CSOC), hotline +66 9 2271 2668 or email cybersecurity@bgrimmpower.com, to ensure timely and proper incident response. When CSOC is notified of or detects an unusual cyber security incident, it will perform investigation, severity assessment, damage control, situation remediation and issue further preventive measures. If a critical incident is detected, CSOC must report to the B.GRIMM CSIRT Steering Committee for supervision and solution. The Corporate Communications team then proceeds to report the incident to employees and related parties.

Cyber Security Management Framework

Source : National Institute of Standards and Technology (NIST) Cyber security Framework 2.0

Policy and Commitment

Governance Structure

B.Grimm Power has appointed a Data Protection Officer (DPO) responsible for developing policies and operational guidelines to ensure compliance with data protection laws and regulations. The DPO oversees personal data risk management, collaborates with internal departments to safeguard data privacy, and leads incident response efforts in the event of data breaches.

Additionally, we have established a Personal Data Protection Committee to oversee the governance, management, monitoring, and auditing of data protection practices. The Internal Audit Division serves as part of this committee, conducting annual reviews and evaluations of data security controls in compliance with the Personal Data Protection Act B.E. 2562 (2019). The committee focuses on identifying high-risk data activities, providing strategic recommendations, and raising employee awareness of data protection laws and compliance requirements.

Strategy

B.Grimm Power has established a data classification policy outlining definitions, rules, regulations, responsibilities, and class-based access rights. The policy defines four data classifications: public, internal use, confidential, and restricted. In addition, we actively manage the risks associated with data privacy protection in product and service design, system and application development, software upgrade and any project involving personal data. We employ the following strategies:

1) We have adopted the Privacy by Design and Privacy by Default principles to identify the data privacy risk factors and implement prevention or mitigation measures.

2) We require a Privacy Impact Assessment (PIA) to identify risks and potential impacts on personal data and implement relevant control measures.

3) We assess our compliance with applicable laws and regulations. Our data privacy complaint channel, dpo@bgrimmpower.com, managed by the Data Protection Officer. The process for responding to data breach incidents is as follows

CSOC detects an incident or received

an incident report from various channels, including the DPO

CSOC investigatigates the incident

to determine the severity level, damage control, situation remindtiation, issue preventive measures, and report back to the DPO.

The DPO reports the incident

to the Board of Directors and the Personal Data Protection Committee within 72 hours.

Responsible teams manage incident communication

Communicates with employees and related parties.

• People Partnership team communicates with internal stakeholders.
• Corporate Communications team engages with external stakeholders and related parties.

We foster awareness and a corporate culture of cyber security and data privacy. All employees are required to complete training and pass a relevant test annually. They are to familiarise themselves with the applicable policies and strictly adhere to cyber security and data privacy rules, regulations and best practices. We enforce a zero-tolerance policy for violators and will take appropriate disciplinary or legal action based on the nature and severity of the offence.

Audit

We demonstrated our commitment to cyber security and personal data protection through consistent assessments and certifications. Our information security management system has achieved certification according to the international standard ISO/IEC 27001:2022 and undergoes regular internal and external audits. We also leverage expertise from external specialists to conduct risk assessments following the standards of NIST. This comprehensive approach ensures our ability to rigorously maintain cyber security and promptly respond to any incidents.