XML 115 R8.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy
We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management system.
We strive to mitigate these risks through cybersecurity risk management, strategy, and governance efforts, which include the safeguarding of our systems and electronic information through a set of cybersecurity controls, processes, proactive monitoring, and disaster recovery plans that seek to minimize business disruptions. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve and recover from cybersecurity incidents in an appropriate manner. These efforts include our risk management process, which comprises frameworks such as the International Organization for Standardization (“ISO”) 27001:2022 and standards published by the National Institute of Standards and Technology. We also perform periodic scans, network vulnerability assessments, penetration tests, adversary simulations and risk assessments.
 Additionally, we engage third-party service providers such as IBM, Microsoft, and HCL Technologies to assist us in managing risks associated with cybersecurity threats. Additionally, we have established processes for third party management which include risk assessment to identify, assess and mitigate risks related to our service providers.
We have a security operations center that provides cybersecurity monitoring, correlation, and response to protect our digital assets, assisted with AI tools and cyberthreat intelligence services. We have an established cybersecurity incident response plan and disaster recovery plans with the objective of handling incidents across the organization that could cause major disruptions to our business. These plans are periodically tested with a view to improvement based on findings, environment changes, and external assessment. Our employees are encouraged to contribute to our cybersecurity efforts. We have implemented awareness and education programs across the company that include phishing simulation campaigns, global webinars, informative material about threats and best practices and a formal security training path.
As of December 31, 2024, risks from cybersecurity threats have not materially affected the company. For more information about these risks, see “Item 3—Key Information—Risk Factors—Risks Relating to Our Business and Operations—We are increasingly dependent on information technology and our systems and infrastructure, as well as those provided by third-party service providers, face certain risks, including cyber-security risks.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management system.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]
As of December 31, 2024, risks from cybersecurity threats have not materially affected the company. For more information about these risks, see “Item 3—Key Information—Risk Factors—Risks Relating to Our Business and Operations—We are increasingly dependent on information technology and our systems and infrastructure, as well as those provided by third-party service providers, face certain risks, including cyber-security risks.”
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance
Our Board of Directors oversees our risk management process, including cybersecurity risks, directly and through its Audit Committee. The Audit Committee of our Board of Directors oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframes. The Audit Committee’s meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, as well as reports on our enterprise risk profile on an annual basis.
We have a dedicated function for cybersecurity management that oversees information security strategy, program, governance, and operations, reporting directly to the Vice President of Information Technology (“VP IT”).
 Our VP IT has over 20 years of experience in various information technology and information security roles and a professional certification as Chief Technology Officer from the Massachusetts Institute of Technology. The VP IT reports to the Audit Committee on cybersecurity risks and strategy on a regular basis. For more information on our Board of Director’s Audit Committee’s responsibilities, including those regarding cybersecurity risk management, please see “Item 6—Senior Management and Directors—Directors, Senior Management, and Employees—The Audit Committee, the Corporate Practices and Finance Committee, and Other Committees.”
Our management takes a risk-based approach in cybersecurity matters and has implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents, including those described under section “—Risk Management and Strategy” above. Our cybersecurity function is mainly responsible for performing regular risk assessments to identify threats to Cemex’s areas, operations, businesses and processes. Cemex’s Information Security Committee is a multidisciplinary team, headed by our cybersecurity function, which evaluates performance metrics, risk mitigation tactics, security policies, and procedures on a regular basis. It reports to the VP IT every six months on metrics, risks, and strategies to be presented to our Board of Director’s Audit Committee.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board of Directors oversees our risk management process, including cybersecurity risks, directly and through its Audit Committee. The Audit Committee of our Board of Directors oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframes.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Board of Directors oversees our risk management process, including cybersecurity risks, directly and through its Audit Committee. The Audit Committee of our Board of Directors oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframes. The Audit Committee’s meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, as well as reports on our enterprise risk profile on an annual basis.
Cybersecurity Risk Role of Management [Text Block] Our management takes a risk-based approach in cybersecurity matters and has implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents, including those described under section “—Risk Management and Strategy” above. Our cybersecurity function is mainly responsible for performing regular risk assessments to identify threats to Cemex’s areas, operations, businesses and processes. Cemex’s Information Security Committee is a multidisciplinary team, headed by our cybersecurity function, which evaluates performance metrics, risk mitigation tactics, security policies, and procedures on a regular basis. It reports to the VP IT every six months on metrics, risks, and strategies to be presented to our Board of Director’s Audit Committee.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] For more information on our Board of Director’s Audit Committee’s responsibilities, including those regarding cybersecurity risk management, please see “Item 6—Senior Management and Directors—Directors, Senior Management, and Employees—The Audit Committee, the Corporate Practices and Finance Committee, and Other Committees.”
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our VP IT has over 20 years of experience in various information technology and information security roles and a professional certification as Chief Technology Officer from the Massachusetts Institute of Technology.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true