XML 121 R52.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management, Strategy and Governance

Under the Company’s articles of association, as supplemented by the audit committee’s charter, the audit committee assists the board of directors in fulfilling its oversight responsibilities relating to the effectiveness of the Company’s systems of internal control, risk management and internal audit over financial reporting. In addition, the Company has established a management-level Critical Risk Committee (“CRC”) that assists the Company’s board of directors, the audit committee and the chief executive officer in connection with the monitoring, assessment and review of risks to which Tenaris is exposed and in the oversight of the risk management framework and processes, with a focus on critical risks (including accidents, cybersecurity and obsolescence, commercial execution, environmental, health and safety and regulatory risks), the development of mitigating actions, and the monitoring of action plans. The CRC, which comprises several senior executives, risk assurance manager and general counsel, periodically reports to the Company’s board of directors, the audit committee and the chief executive officer on its activities. For more information on the audit committee and CRC, see “Risk Factors – Risks Relating to Our Business and Industry – Cyberattacks could have a material adverse impact on our business and results of operations”.

In particular, with respect to cybersecurity risks, Tenaris has adopted a “Cybersecurity Risk Management Methodology”, which sets forth a procedure to monitor, identify, communicate, assess the impact and likelihood and report actual or potential risks affecting Tenaris’s information systems, including platform, networking and systems vulnerabilities, processes, sensitive information leak or loss. The objective of our Cybersecurity Risk Management Methodology is to reduce, accept, transfer, or avoid the effects of such risks thereby reducing accidents, harm, losses, disruption to services, or other negative impacts. Our risk assessment methodology considers the potential impact of cybersecurity risks with respect to continuity of operations, information security (including confidentiality, integrity and availability), financial performance, compliance or reputational effects, and health, safety and environment damages. In addition, the adopted methodology considers the probability of occurrence of each event based on factors that vary according to specific risks. A Cybersecurity Risk Catalog is used to register detected risks, document risk assessments, and adopt appropriate action plans and reporting measures. If deemed appropriate (for example, when specific knowledge is required) specialized consultants may be engaged in connection with cybersecurity risk processes.

Tenaris has adopted certain other cybersecurity procedures that complement the above-mentioned Cybersecurity Risk Management Methodology and seek to effectively manage cybersecurity incidents by analyzing potential impacts, containing the attack, eradicating the threat, and recovering from the incident, instruct users of Tenaris’s information systems on how to respond to cybersecurity incidents involving or affecting Tenaris IT resources or devices through which users may access any Tenaris’s IT systems; and provide instructions and best practices to Tenaris’s personnel with system administrator’s roles in connection with cybersecurity incidents prevention, detection and response. In 2024, we adopted a process to assess third-parties cybersecurity, to the extent they are connected to Tenaris or process Tenaris’s confidential information.

Tenaris has also adopted a “Ransomware Crisis Management Procedure” setting forth the procedure to timely and adequately respond to a ransomware incident. In addition, because a cybersecurity incident may escalate into a major company crisis, “Tenaris’s Crisis Management Procedure” is triggered and applied when certain events signal potential material impacts.

Tenaris’s policies, processes and procedures established to detect and manage cybersecurity risks are monitored and coordinated by a team of experienced and recognized professionals, including a chief information security officer, a cybersecurity risk management director and a cybersecurity and security architecture director, with an average of more than 25 years of experience in cybersecurity and information technology fields. The chief information security officer periodically reports on its activities to the CRC.

During 2024, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, or third-parties cybersecurity incidents, lead to known breaches of our business-critical IT systems and, as such, have not materially affected, or are reasonably likely to materially affect, Tenaris, including its business strategy, results of operations, or financial condition.

Tenaris has adopted cyber-resilience standards as part of its cybersecurity strategy and cyber capabilities. For example, a cyberattack simulation exercise was carried out in 2024 with an external consultant (KPMG) acting as a cyber attacker and Tenaris’s cybersecurity team acting as defenders, showing the Company’s strong commitment to cybersecurity issues, particularly associated risks, potential impacts and action plans. The results of such exercise are still subject to evaluation and will aid in building a stronger cybersecurity strategy.

For more information on cybersecurity risks, see “Risk Factors – Risks Relating to Our Business and Industry – Cyberattacks could have a material adverse impact on our business and results of operations”.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our risk assessment methodology considers the potential impact of cybersecurity risks with respect to continuity of operations, information security (including confidentiality, integrity and availability), financial performance, compliance or reputational effects, and health, safety and environment damages.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Under the Company’s articles of association, as supplemented by the audit committee’s charter, the audit committee assists the board of directors in fulfilling its oversight responsibilities relating to the effectiveness of the Company’s systems of internal control, risk management and internal audit over financial reporting. In addition, the Company has established a management-level Critical Risk Committee (“CRC”) that assists the Company’s board of directors, the audit committee and the chief executive officer in connection with the monitoring, assessment and review of risks to which Tenaris is exposed and in the oversight of the risk management framework and processes, with a focus on critical risks (including accidents, cybersecurity and obsolescence, commercial execution, environmental, health and safety and regulatory risks), the development of mitigating actions, and the monitoring of action plans. The CRC, which comprises several senior executives, risk assurance manager and general counsel, periodically reports to the Company’s board of directors, the audit committee and the chief executive officer on its activities. For more information on the audit committee and CRC, see “Risk Factors – Risks Relating to Our Business and Industry – Cyberattacks could have a material adverse impact on our business and results of operations”.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] In addition, the Company has established a management-level Critical Risk Committee (“CRC”) that assists the Company’s board of directors, the audit committee and the chief executive officer in connection with the monitoring, assessment and review of risks to which Tenaris is exposed and in the oversight of the risk management framework and processes, with a focus on critical risks (including accidents, cybersecurity and obsolescence, commercial execution, environmental, health and safety and regulatory risks), the development of mitigating actions, and the monitoring of action plans.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] In addition, the Company has established a management-level Critical Risk Committee (“CRC”) that assists the Company’s board of directors, the audit committee and the chief executive officer in connection with the monitoring, assessment and review of risks to which Tenaris is exposed and in the oversight of the risk management framework and processes, with a focus on critical risks (including accidents, cybersecurity and obsolescence, commercial execution, environmental, health and safety and regulatory risks), the development of mitigating actions, and the monitoring of action plans. The CRC, which comprises several senior executives, risk assurance manager and general counsel, periodically reports to the Company’s board of directors, the audit committee and the chief executive officer on its activities. For more information on the audit committee and CRC, see “Risk Factors – Risks Relating to Our Business and Industry – Cyberattacks could have a material adverse impact on our business and results of operations”.
Cybersecurity Risk Role of Management [Text Block]

Tenaris’s policies, processes and procedures established to detect and manage cybersecurity risks are monitored and coordinated by a team of experienced and recognized professionals, including a chief information security officer, a cybersecurity risk management director and a cybersecurity and security architecture director, with an average of more than 25 years of experience in cybersecurity and information technology fields. The chief information security officer periodically reports on its activities to the CRC.

During 2024, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, or third-parties cybersecurity incidents, lead to known breaches of our business-critical IT systems and, as such, have not materially affected, or are reasonably likely to materially affect, Tenaris, including its business strategy, results of operations, or financial condition.

Tenaris has adopted cyber-resilience standards as part of its cybersecurity strategy and cyber capabilities. For example, a cyberattack simulation exercise was carried out in 2024 with an external consultant (KPMG) acting as a cyber attacker and Tenaris’s cybersecurity team acting as defenders, showing the Company’s strong commitment to cybersecurity issues, particularly associated risks, potential impacts and action plans. The results of such exercise are still subject to evaluation and will aid in building a stronger cybersecurity strategy.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

Tenaris’s policies, processes and procedures established to detect and manage cybersecurity risks are monitored and coordinated by a team of experienced and recognized professionals, including a chief information security officer, a cybersecurity risk management director and a cybersecurity and security architecture director, with an average of more than 25 years of experience in cybersecurity and information technology fields. The chief information security officer periodically reports on its activities to the CRC.

Cybersecurity Risk Management Expertise of Management Responsible [Text Block] a chief information security officer, a cybersecurity risk management director and a cybersecurity and security architecture director, with an average of more than 25 years of experience in cybersecurity and information technology fields.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Tenaris has adopted cyber-resilience standards as part of its cybersecurity strategy and cyber capabilities. For example, a cyberattack simulation exercise was carried out in 2024 with an external consultant (KPMG) acting as a cyber attacker and Tenaris’s cybersecurity team acting as defenders, showing the Company’s strong commitment to cybersecurity issues, particularly associated risks, potential impacts and action plans. The results of such exercise are still subject to evaluation and will aid in building a stronger cybersecurity strategy.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true