XML 484 R39.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Jun. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Strategic context and risk management
DRDGOLD relies on various IT systems and physical infrastructure to support its mining operations including the solar plant and
administrative activities which includes data capturing, processing, and storage. In certain instances, such data may be classified as
confidential. This reliance exposes to cybersecurity risks including breaches or damage to our systems by computer viruses and system
attacks and unauthorized physical or electronic access. Any system failure, accident or security breach could result in business disruption,
theft of our intellectual property, disclosure of confidential information, reputational damage or litigation. Refer to item 3D. Risk factors risk
entitled “A disruption in our information technology systems, including incidents related to cyber security, could adversely affect our
business operations” for a full description. 
DRDGOLD’s operations are underpinned by a robust digital and physical infrastructure, supporting mining activities, renewable
energy initiatives including the solar plant, and administrative functions. These systems handle sensitive and confidential data, making
cybersecurity a critical strategic and operational priority.
Cybersecurity risks include:
Malicious cyberattacks (e.g., ransomware, phishing)
Unauthorized access to systems or data
System failures or data corruption
Third-party vulnerabilities
Cybersecurity Strategy and Controls
DRDGOLD adopts a comprehensive, integrated cybersecurity strategy that aligns with internationally recognised standards and
frameworks, including:
ISO/IEC 27001
NIST Cybersecurity Framework (CSF)
CIS Critical Security Controls
Key components of the strategy include periodic risk reviews conducted jointly by the IT and Risk & Assurance departments and
mandatory cybersecurity training for all employees to foster a culture of awareness and accountability.
An external cybersecurity assurance provider is engaged as part of the Group’s Combined Assurance Model to independently assess the
robustness of the cybersecurity risk management process and the effectiveness of implemented controls.
Third-party Risk Management
Given the interconnected nature of DRDGOLD’s systems, vendor cybersecurity is a key focus area. The Business Intelligent ("BI") platform
is used to assess and monitor third-party risks, particularly for critical vendors. Vendors with access to DRDGOLD systems are required to
provide assurance of their cybersecurity posture through:
Independent SOC 2 Type II reports, or
Completion of cybersecurity assessments via the BI platform
These assessments are integrated into the broader ERM process to ensure alignment with the Group’s risk appetite and control environment.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Cybersecurity Strategy and Controls
DRDGOLD adopts a comprehensive, integrated cybersecurity strategy that aligns with internationally recognised standards and
frameworks, including:
ISO/IEC 27001
NIST Cybersecurity Framework (CSF)
CIS Critical Security Controls
Key components of the strategy include periodic risk reviews conducted jointly by the IT and Risk & Assurance departments and
mandatory cybersecurity training for all employees to foster a culture of awareness and accountability.
An external cybersecurity assurance provider is engaged as part of the Group’s Combined Assurance Model to independently assess the
robustness of the cybersecurity risk management process and the effectiveness of implemented controls.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Governance and oversight
Management oversight
DRDGOLD has an appointed Chief Information and Technology Officer (“CITO”) who is accountable and a head of Cyber
Security (“HCS”) who is responsible for the assessment and management of material risks from cyber security threats. The HCS is also
responsible for ensuring that any remedial actions reported through the combined assurance program are adequately addressed.
The CITO, with over 16 years of experience, is an invitee to the DRDGOLD executive committee which meets on a bi-weekly
basis where he reports back on cybersecurity matters.
The HCS is responsible for managing cybersecurity risks, implementing controls and ensuring remediation of findings from
assurance activities.
Board of directors oversight
DRDGOLD’s board of directors provide strategic oversight of cybersecurity through its Risk Committee. The Risk Committee
receives quarterly reports on its enterprise risk assessment processes which includes cybersecurity risks and reportable cyber security
incidents. The Audit Committee is kept informed of material cyber risks facing the organization through the reporting on general information
technology controls, aligned with the Company’s COSO 2013 framework.
The governance structure ensures that cybersecurity is embedded in decision-making and risk oversight processes at all levels of
the organization.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] DRDGOLD’s board of directors provide strategic oversight of cybersecurity through its Risk Committee.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Risk Committee
receives quarterly reports on its enterprise risk assessment processes which includes cybersecurity risks and reportable cyber security
incidents.
Cybersecurity Risk Role of Management [Text Block] Management oversight
DRDGOLD has an appointed Chief Information and Technology Officer (“CITO”) who is accountable and a head of Cyber
Security (“HCS”) who is responsible for the assessment and management of material risks from cyber security threats. The HCS is also
responsible for ensuring that any remedial actions reported through the combined assurance program are adequately addressed.
The CITO, with over 16 years of experience, is an invitee to the DRDGOLD executive committee which meets on a bi-weekly
basis where he reports back on cybersecurity matters.
The HCS is responsible for managing cybersecurity risks, implementing controls and ensuring remediation of findings from
assurance activities.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] DRDGOLD has an appointed Chief Information and Technology Officer (“CITO”) who is accountable and a head of Cyber
Security (“HCS”) who is responsible for the assessment and management of material risks from cyber security threats. The HCS is also
responsible for ensuring that any remedial actions reported through the combined assurance program are adequately addressed.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] over 16 years of experience
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] invitee to the DRDGOLD executive committee which meets on a bi-weekly basis where he reports back on cybersecurity matters.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true