Under our risk management framework, the Board and management are responsible for identifying and analysing the risks related to information and cyber security, and for determining how such risks should be managed and mitigated.