Cybersecurity and Data Protection
Protecting the information of our customers, employees, and partners is a fundamental commitment that is integrated into our daily operations.
At Fibra Shop, we manage cybersecurity under a comprehensive approach that prioritizes the confidentiality, integrity, and availability of data, through the implementation of controls, policies, and oversight mechanisms aligned with international best practices.
Cybersecurity management is integrated into our corporate governance framework, with Board-level oversight and coordination with the Finance Department, ensuring its incorporation into internal control and risk management processes. This model enables informed decision-making and a timely response to emerging technological risks.
We have an organizational structure specializing in information technology and security, made up of professionals with technical and operational experience, as well as an external support scheme under a CISO as a Service model. This structure strengthens the identification, assessment, and mitigation of cybersecurity risks, in line with international standards. The Information Technology area is made up of:
- Oscar Valdez: Bachelor’s in Computer Systems and Master’s in Systems Engineering.
- Rogelio Moro: Engineer in Communications and Electronics with a specialization in Computing.
- Daniel Ramírez: Systems Engineer.
- Rodrigo Sánchez: IT Support Technician
In 2025, no substantiated complaints regarding violations of data privacy were received, nor were any incidents of customer information leakage, theft, or loss recorded. These results reflect the effectiveness of controls and measures implemented in this area.
Regulatory Framework and Security Policies
Our management is supported by an internal regulatory framework that establishes clear guidelines for protecting information, including:
Information Security Training:
Training and awareness in information security are key pillars of our strategy. During 2025, we implemented a comprehensive training program aimed at both end users and specialized personnel, covering topics such as:
- Prevention of phishing risks and cyber threats.
- Strengthening of technical security capabilities.
- Development of skills in cybersecurity architecture and management.
- Integration of security into technology development processes.
- Gap analysis and adoption of international standards.
Operational Continuity and Technological Resilience
As part of our strategy to strengthen technological resilience, during 2025 we implemented several actions aimed at reinforcing our technological infrastructure and ensuring operational continuity, including:
- Implementation of automated backups of critical information.
- Redundancy in communication links to strengthen connectivity.
- Adoption of disaster recovery solutions (Disaster Recovery as a Service).
- Replacement and modernization of key technological infrastructure.
- Implementation of uninterruptible power supply (UPS) systems.
- Optimization of environmental conditions in data centers.
This approach is complemented by the progressive implementation of business continuity and incident response plans, which are being formalized and updated, evolving toward a more robust model that includes documented protocols, periodic testing, and continuous improvement mechanisms.
Risk Management and Security Assessments
In terms of risk management, we conduct semi-annual vulnerability assessments, with the goal of:
- Identifying weaknesses in the technological infrastructure.
- Assessing the level of exposure to cybersecurity risks.
- Prioritizing corrective and mitigation actions.
- Continuously strengthening our security posture.
The results of these analyses are used as input for decision-making and to improve existing controls, under a preventive, proactive approach.
In addition, we have conducted independent external assessments of the technological infrastructure and information security controls with the support of cybersecurity specialists. These assessments help identify vulnerabilities, assess the effectiveness of existing controls, and define improvement actions.
While we do not currently hold formal certification under standards such as ISO 27001, the organization is making progress toward gradual alignment with international best practices.
Regarding oversight mechanisms, Fibra Shop has internal audit processes that periodically review compliance with controls, as well as oversight from the Audit Committee, which monitors relevant technology-related risks and controls. This model is complemented by periodic vulnerability assessments, which strengthen comprehensive risk management.
