Fiscal 2022 Universal Registration Document

Impact

On a daily basis, Sodexo IT systems process the data of 422,000 Sodexo employees and 100 million consumers; including patients in hospitals. In addition, the demand for new innovative and efficient services creates a fast changing and highly interconnected architecture. Sodexo is also a target for cyber criminals who want to exploit its weaknesses and gain access to the data of the thousands of clients and suppliers, to whom Sodexo is connected. Within this challenging environment, information security issues such as poor data integrity, loss of data confidentiality and lack of availability of key systems, or collaboration services, could result in high cost and/or high-volume impacts such as:

• inaccurate financial reporting;

• contractual penalties;

• regulatory fines;

• reputational damage with shareholders, clients, consumers, suppliers and employees.

Examples of Mitigating Activities

• Group Information and Systems Security Policy aligned to ISO 27001 framework, with detailed security directives on key topics (e.g. security by design, cloud services, incident management).

• Investment in security infrastructure, tools and services such as multi-factor authentication, laptop encryption, security risk assessments, email monitoring and endpoint detection and response.

• Events and incidents monitored through a Security Operations Centre.

• Global cyber incident management and response process

• Global Data Center consolidation strategy focused on using trusted hosting partners to provide secure and efficient services.

• Company-wide collaboration on security and compliance topics such as data privacy, cyber threats, new technologies and IT internal controls facilitated by formal Governance Committees and cross entity network groups.