Sustainable governance as a management model

Strengthening the corruption prevention system

Activate and maintain an Anti-Corruption Management System

Maintain ISO 37001 certification (covering all Company sites) during the 2026–2030 five-year period

Provide specific anti-corruption training

Training (with test successfully passed) for employees as follows:

• 40% in 2026;
• 45% in 2027;
• 50% in 2028;
• 55% in 2029;
• 60% in 2030

Strengthening internal controls

Plan and carry out anti-corruption audits

At least 1 internal anti-corruption audit per year

Strengthening existing control measures and principles of conduct to prevent the offences regulated by Legislative Decree 231/01

Keep Model 231 and the Code of Ethics up to date

Updated Model 231 and Code of Ethics

Provide specific training on the updated Model 231 and Code of Ethics

Training (with test successfully passed) for employees as follows:

• 40% in 2026;
• 45% in 2027;
• 50% in 2028;
• 55% in 2029;
• 60% in 2030

Equipping the company with a non-financial reporting system

Draft the Sustainability Report in line with ESRS standards and CSRD requirements

Preparation of the Sustainability Report for each year of the 2026–2030 five-year period

Business continuity, incident reduction and response

Perform business continuity and incident response tests ≥ 1/year

At least 1 test per year

≤ 5% of security incidents taken in charge more than 2 hours after reporting in the last six months

% of security incidents taken in charge more than 2 hours after reporting in the last six months

Reducing average response time to security incidents (normalised MTTR)

Continuous monitoring of security events; optimisation of incident response processes; strengthening detection and incident management capabilities

5% reduction in the normalised MTTR value

Ensuring data integrity and compliance with Regulation (EU) 2016/679 – GDPR

Deliver training to staff on information security and privacy

At least 50% of staff (out of total headcount as of 31/10 each year) trained annually during the 2026–2030 five-year period

Deliver cybersecurity training to staff with a corporate email account

At least 50% of staff (out of total headcount as of 31/10 each year) trained annually during the 2026–2030 five-year period