Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

We have built and continue to evolve processes for assessing, identifying, and managing material risks from cybersecurity threats. We have embedded the oversight and management of cybersecurity risk within our enterprise risk management framework to help drive a company-wide culture of cybersecurity risk management, and we have established policies and procedures as well as a reporting line of governance that guide our cybersecurity risk management program.

We maintain a cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers. Our processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our risk management system. We use a variety of tools and processes to collect relevant data and identify, monitor, assess and manage material cybersecurity risks. The Group has adequate management of security incidents, a strategy for dealing with and governing cybersecurity risks through the following elements:

●

Corporate Information Security Policy. Our corporate information security policy addresses the information technology mechanisms, domains and services that protect the Group’s information assets. Our Information Security Committee is responsible for carrying out the activities set forth in our corporate information policy and this committee is involved in all actions, decisions and updates on the group’s security information (events, incidents, training, tools, etc.). The Information Security Committee prepares a report that is presented to the Audit Committee.

●

Two procedures are implemented for the timely attention of incidents and IT risks:

	Ø	Procedure for Information Security Incident Management: This procedure provides the necessary guidelines to ensure adequate security incident management to address any type of service interruption: recording, categorizing, prioritizing, controlling, resolving, and closing all security incidents within the IT services that are provided or managed by the Group.

	Ø	Procedure for Technology Risk Assessment: This procedure provides the necessary guidelines for the implementation of controls based on Risk Determination and Evaluation. These controls will allow the Group to mitigate, avoid, transfer or accept the risks. These activities will reduce the attack surface of all Information Technology assets that are provided or managed by the group. During 2024, residual risk was determined as part of the process improvement. This information was obtained by measuring the controls implemented last year, compared to the current risk level.

Our Corporate Chief Information Officer, Mauricio Alvarez (“CIO”) is also responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has significant experience in information technology and many of our information technology team members hold qualifications in technology security positions. Our CIO, together with our security team members, reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.

The team in charge of the Group’s Cybersecurity is made up of:

	●	Mauricio Alvarez joined Betterware as CIO in August 2020 and is responsible for information technology spanning applications, data, cybersecurity and infrastructure, all a vital part of nearly every aspect of our customer and service experience. Mauricio joined Betterware from multinational customer experience companies including Atento where he was Chief Information Officer for the U.S., Mexico, and Central America. Before Atento, Mauricio co-founded Flip Technologies, a SaaS provider for nonprofit organizations and held various IT & Innovation leadership roles of increasing responsibility at The Coca-Cola Company globally. Mauricio holds a bachelor’s degree in computer systems from the Universidad Iberoamericana in Mexico City.

	●	Nuxi Pérez, joined Betterware in December 2021 and is the Director of Infrastructure and Technical Support. He has more than 16 years of progressive experience in infrastructure, telecommunications, and cybersecurity, a bachelor’s degree in computer systems engineering from ESIME - IPN in Mexico City, a degree in strategic cybersecurity from the AMEST academy and ITIL certification.

	●	Claudia Rodríguez, joined Betterware in October 2022 to further strengthen our cybersecurity management. Claudia has EC Council Ethical Hacking, ITIL, CobIt and MOF certifications, as well as a Cybersecurity Technologies Associate’s Degree by the Tecnologico de Monterrey, and has several years of experience with Information Security.

We provide cybersecurity awareness training to our employees which is designed to provide guidance for identifying and reporting cybersecurity risks and to promote familiarity with our cybersecurity policies. We also use internal communications to promote awareness and conduct phishing exercises and provide training to employees. In addition, we engage independent third parties on an as-needed basis to assess our cybersecurity capabilities. The results of these assessments are shared with our Information Security Committee.

Our board of directors oversees management’s approach to managing cybersecurity risks as part of its risk management oversight. Our board of directors holds periodic discussions with management regarding our guidelines and policies with respect to cybersecurity risks and receives regular reports from the CIO regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks.

During 2024, we experienced an increase in the number of phishing attacks where some users executed links or attachments. These activities were mitigated in a timely manner. None of these incidents has significantly affected, nor is it reasonably likely to significantly affect, the Group or our business strategy, operating results, or financial condition.

Third-party vendor agreements include confidentiality obligations and specify data elements that the third party has access to, how the third party protects the data, and procedures for the return or destruction of protected data. The vendors/third parties also must report all cybersecurity incidents immediately to the Company’s responsible functional manager and to the Director of Information Technology. All relevant third parties are required to provide a SOC 1 Type II report which is monitored and reviewed by the company. We evaluate any potential risks or deviations communicated within these reports.

However, we cannot guarantee any future events will not affect our operations or customers. We are constantly seeking to improve and strengthen our security strategy by aligning it with Security Frameworks and Best Practices such as NIST CSF and ISO 27000.

Cybersecurity Risk Management Processes Integrated [Text Block]

Our processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our risk management system.

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

Our Corporate Chief Information Officer, Mauricio Alvarez (“CIO”) is also responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has significant experience in information technology and many of our information technology team members hold qualifications in technology security positions. Our CIO, together with our security team members, reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.

Cybersecurity Risk Management Third Party Engaged [Flag]

true