Sustainability Data and Reporting

Management has sought independent, third-party verification of a range of metrics in this report. This includes selected data on safety performance, training and development, education initiatives, First Nations Australian employment, heritage sites, the Billion Opportunities program and gender diversity. All other metrics undergo a process of internal verification. 

Independent assurance on emissions data is detailed in our Climate Change Report in the FY25 Annual Report available in our Document Library. 

We value all feedback. Please forward any comments on this report or requests for additional information to sustainability@fortescue.com.

Cybersecurity is governed through our enterprise Cyber Security Framework, aligned to the NIST Cybersecurity Framework and the Australian Energy Sector Cyber Security Framework. Oversight is provided by our Board and the Audit, Financial, and Risk Management Committee, ensuring transparency and accountability over cyber risk and internal controls.

Fortescue is committed to delivering the capabilities needed to protect our operations from potential threats, adopting an enterprise approach to reducing risk, and aligning with our priorities to make informed decisions. Our Cyber Security Policy outlines this commitment and our strategy to achieve this. Key areas are described below.

Controls are in place across our systems to ensure data integrity, traceability, and reliability. Access controls, data validation, audit logging, and version control help to ensure the accuracy and accountability of the data we manage.

Internal audits are conducted periodically on our infrastructure and cyber controls to validate system performance and ensure ongoing compliance with regulatory and internal requirements.

Our digital infrastructure includes highly automated mining, processing, and renewable energy assets. Operational Technology (OT) systems are protected through controls across their whole lifecycle, from design and commissioning to monitoring and recovery. These systems directly support our decarbonisation and climate adaptation programs, and cyber security forms an integral part of our cyber resilience strategy.

We conduct regular scenario testing and red team exercises to validate our ability to detect, respond to, and recover from cyber events across both IT and OT environments.

All new employees and contractors are required to complete cyber security training before gaining access to our systems. Our cyber awareness program provides ongoing training and updates on best practices for cyber security.

Fortescue's security requirements associated with assets within the Industrial Control System Environment include:

• Vulnerability and patch management program to identify, classify, remediate, and mitigate vulnerabilities, followed by governance reporting. It uses threat intelligence, scanning, and vendor advisories, with compensative controls for unpatchable assets.
• Enforcement of backup and recovery procedures to guarantee seamless recovery after potential security incidents, ensuring the continuity of operations.

As reliance on third-party platforms and vendors grows, we actively manage cyber risks through structured assessments, security requirements in contracts, and controlled access to our environments. Vendor cyber posture is assessed during onboarding and renewal, with controls aligned to our Cyber Security Framework. This includes evaluating security certifications, incident response readiness, and data handling practices.

Third-party access, particularly into OT environments, is tightly controlled. Access is granted only through approved channels with strict cyber security controls. This approach ensures vendors can operate effectively while maintaining data integrity, system resilience, and strong governance over external access.