Governance

Our approach

Santos is obligated to comply with the Australian Security of Critical Infrastructure Act (2018) and related amendments for Australian assets, and similar international regulations for non-Australian assets. To comply with these obligations Santos has enacted a cyber risk management framework based on the Australian Energy Sector Cyber Security Framework (AESCSF). The AESCSF leverages the National Institute of Standards and Technology (NIST) cyber security framework which guides Santos’ overall Risk Management Framework to manage cyber security threats.

Santos adheres to the Australian Privacy Act (1988) and similar international legislation in locations where we operate. Privacy policies are available on the Santos website, and a register of Personal Identifiable Information is kept within the company. Please refer to santos.com/privacy for further information on how this is protected.

Establishing individual responsibilities for information security for the entire workforce

Santos ensure that all staff understand their responsibilities for information security through mandatory cyber security induction for all employees and contractors. This is augmented by ongoing staff cyber awareness training (such as targeted training for at-risk teams, password strength guidance and phishing awareness).

All staff are required to adhere to the Santos Management System (SMS) which sets the mandatory requirements for how the business operates.  It comprises of policies, standards and procedures for the entire business.  Cyber security requirements are captured within the SMS.

Establishing Information requirements for third parties

Santos ensures all third parties are aware of their information security responsibilities via the ‘Supplier Data Protection Requirements’ document on the Procurement section of the corporate website.

This document outlines key information security requirements for third parties.

Information Security Governance

The company Chief Information Officer (CIO) is responsible for information security and is directly supported by a dedicated Information Security Manager.

A Board-level Audit and Risk Committee is in place to oversee cyber security risks and compliance, with regular reports on cyber security posture, risk status and cyber programs provided to the Committee.

An assurance calendar is in place and published to the Committee showing timing of annual cyber security activities, including internal and external audits, penetration testing and training schedules.

Information Security Management

The company has an information security management program published within the SMS which covers the following topics:

• Information Security Management
• Cyber Security Risk Management
• Data & Information Management
• Supplier Data Protection
• Acceptable Use
• System Acquisition and Disposal
• Identity and Access Management
• Personally Identifiable Information Management
• Software Acquisition
• Disaster Recovery

Our policy, process and due diligence

The AESCSF framework provides for both preventative and responsive controls to protect information held by Santos, including Personal Identifiable Information (PII). All systems (including those holding PII) and data are protected by leading industry-standard cyber security products and practices, with no notifiable or material cyber or information breaches occurring in the last 12 months.

Santos is a participant of, and contributor to, the Australian Government’s Critical Infrastructure Information Exchange forum, and meets regularly with regulatory officials, law enforcement and peers to exchange intelligence on emerging threats and trends.

Assessment of cyber security posture and controls is performed throughout the year, with annual benchmarking of performance through both internal and external audits, penetration testing and other evaluations.

Key programs and initiatives include:

• Santos maintains a robust and dynamic program of both capital and operationally funded security improvement initiatives. These initiatives focus on the continuous enhancement of existing cyber security controls to address evolving threats and ensure compliance with regulatory requirements.
• Our program emphasises regular updates to current systems, ensuring they remain aligned with the latest industry standards and technologies. Additionally, we conduct frequent audits, readiness assessments, and incident response simulations to evaluate and strengthen our ability to counteract potential threats effectively.
• To stay ahead of emerging cyber security risks, Santos is committed to the proactive adoption and integration of new technologies, tools, and systems designed to enhance our defensive capabilities. This approach ensures that we not only meet today’s challenges but also anticipate and prepare for the evolving cyber security landscape.