Policies

Information security and information technology policy

Veitur focuses on increasing value creation through the efficient use of technology solutions owned and managed by it. Information security management is a key element in reducing risks and preventing incidents that could cause damage or disruption to Veitur's operations.

The policy ensures that technology solutions are in line with Veitur's overall strategy. The policy covers the entire value chain, including cooperation with suppliers and service providers.

Veitur considers secure and transparent handling and retention of information as a fundamental element in supporting decision-making and the continuous operation of the company, ensuring the confidentiality, accuracy and availability of information.

Policy focuses:

• Risk management: Decisions about IT and information security are based on a formal risk assessment and the board's risk tolerance. Strong risk management is implemented and appropriate security measures are implemented to ensure resilience and stability.
• Awareness and training: Employees are key to a responsible security culture. Veitur emphasizes regular education and training to enhance awareness, responsibility and skills in handling information and technology solutions. Strong awareness and responsibility are key elements of Veitur's security culture.
• Information security management system: Maintain an information security management system in accordance with the ISO 27001 standard. Legal and recognized requirements are met and continuous improvements are made through regular reviews.
• Response plans for serious incidents: Veitur maintains structured and tested response plans that ensure rapid response and resilience to serious threats and incidents.
• Accessibility and security: Users have access to the information and services they need at all times – "Open but secure"
• Responsible management of technology solutions: The development and implementation of technology solutions follows best practices and supporting documentation for software solutions.

[Policy approved at the board meeting 11.12.2025]