Data Privacy and Cybersecurity

At FPS, we recognize the critical importance of safeguarding digital assets and proactively addressing the evolving risks associated with digitalization.

According to the World Economic Forum’s Global Risks Report 2025, cybersecurity and data privacy are among the top global risks of the next decade. At FPS, we recognize the critical importance of safeguarding digital assets and proactively addressing the evolving risks associated with digitalization.

Protecting the information of our customers, colleagues, and business partners is not only a technical necessity, but a fundamental ethical and governance responsibility.

Policy

We manage information security through a comprehensive set of global policies, including:

• Access control

• Backup and disaster recovery

• Business resilience

• Change management

• Cloud

• Information classification

• Information security

• Information Security Management System

• IT end-user

• Secure development

These policies form the foundation of our security posture across all facilities. As of 2025, our three largest operational sites implemented an information security management system certified to the ISO 27001 standard. All three of these sites have been certified since 2018, demonstrating strong compliance with global data protection and cybersecurity standards, including the EU’s GDPR.

Our cybersecurity infrastructure is managed by a dedicated Cybersecurity Partner working together with the Global IT Department. This team regularly monitors system performance and prepares monthly reports for the global service team and Global IT Director.

Any major changes to systems, policies, or infrastructure are reviewed and approved by FPS’s senior leadership team to ensure coordinated and secure implementation.

FPS colleagues play an active role in our information security strategy. All colleagues receive annual cybersecurity training, structured into five core modules addressing various threat scenarios.

Modules must be completed within two months, and progress is monitored through internal dashboards. We also conduct regular phishing simulations. If a colleague fails a phishing test, they are directed to complete additional training. Reporting suspicious emails is facilitated through the Phishing Alert Button in Outlook or by contacting the FPS IT Service Desk.

Thanks to these proactive measures, there were no reported cybersecurity incidents or data breaches across FPS in 2025.

Actions and Initiatives

We manage and safeguard various types of sensitive information, including Personally Identifiable Information and Personal Health Information, recognizing the importance of protecting it from unauthorized access, disclosure, modification, or misuse.

Maintaining strong data security is essential not only for preserving trust but also for complying with data protection regulations.

To strengthen our cybersecurity defenses, we work with a third-party vendor to monitor and update our firewall systems regularly.

Additionally, we partner with an external firm to perform biannual vulnerability assessments and penetration tests.