Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Identified risks, including cybersecurity risks, are categorized as critical, very significant, significant or less significant, based on their potential impact, likelihood of occurrence and severity. Critical, very significant and significant risks and are assessed or reassessed at least three times per year. In today's digital age, where cybersecurity is a critical priority for organizations, collaboration with third-party service providers has become increasingly common and necessary. Third-party service providers play a critical role in strengthening information security processes, providing specialized expertise and additional resources to address the complexities of the ever-evolving cyber threat landscape. In 2025, Ternium created a new position that absorbed the Global Cybersecurity Director position. Our cybersecurity programme is now led by our Global Cybersecurity, Risk and Privacy Senior Director, who acts as the internal focal point for risk management and implementation of security control, as well as the main engagement focal point with technology / cybersecurity internal or external audits or assessments. The cybersecurity programme encompasses the design, implementation, operation and monitoring controls of both Information Technology and Operational Technology digital and physical assets. We recognize that cybersecurity encompasses a wide range of expertise, and it is in these cases that we turn to specialized consultants. Specialized cybersecurity consultants are engaged when specific expertise is required to address particular challenges or to conduct comprehensive risk assessments. These professionals bring a valuable external perspective, offering expertise and skills that complement our team's internal capabilities. Tasks and responsibilities outsourced to third-party service providers may include: 1. Risk and Vulnerability Assessment: Consultants can conduct comprehensive risk assessments and vulnerability scans to identify potential gaps in our security infrastructure. 2. Security audits: They perform independent audits to ensure compliance with information security standards and regulations, or industry-specific regulations. 3. Penetration Testing: Consultants perform ethical penetration tests to identify weaknesses in our network and systems, simulating real attacks to evaluate the resistance of our defenses. 4. Development of security policies and controls: They collaborate in the creation and review of information security policies, as well as in the design and implementation of appropriate controls to mitigate risks. 5. Training and awareness: They provide cybersecurity training and awareness programs for our staff, helping to promote a culture of security throughout the organization. 6. Security Operation Centers ("SOC"): The SOC plays a critical role in detecting, analyzing and responding to security incidents in real time. Tasks are distributed between external vendors and the Global Cybersecurity, Risk and Privacy Senior Director based on the nature and scope of each project. The Global Cybersecurity, Risk and Privacy Senior Director and his team closely monitor all cybersecurity-related activities, ensuring that they align with the organization's security objectives and standards. In addition, he or she coordinates communication and collaboration between third-party vendors and other relevant internal teams, ensuring effective integration of cybersecurity efforts across the enterprise. Third-party vendors are carefully selected based on their experience, credentials and demonstrated capabilities in the cybersecurity field. We look for vendors who hold recognized certifications, and who have a proven track record of success in similar projects. Transparency and trust are core values in our relationship with third-party vendors, and we work closely with them to ensure comprehensive protection of our information assets. Our Global Cybersecurity, Risk and Privacy Senior Director has been working on Ternium’s cybersecurity area since 2011. He holds a Bsc in Computing and Information Systems from Goldsmiths College, University of London, UK and professional certifications such as CISSP – Certified Information Systems Security Professional from ISC2 (International Information Systems Security Certification Consortium), CISA-Certified Information Systems Auditor, CGEIT-Certified in the Governance of Enterprise IT and CISM-Certified Information Security Manager from ISACA (Information Systems and Control Association). As Ternium relies heavily on information systems to conduct its operations, it has adopted information security policies and controls aligned with the industry’s best practices and standards, in compliance with international frameworks including the U.S. National Institute of Standards and Technology, or NIST, the Open Worldwide Application Security Project, or OWASP, and ISO, among others. Our information security teams regularly evaluate the effectiveness of our policies and controls, learning from past incidents and implementing continuous improvements. We engage with Ternium employees via periodic awareness training sessions. We closely evaluate and supervise the information security practices of our suppliers and third parties with access to our assets and critical data. For a description of some of the risks relating to cybersecurity threats see Item 3. "Key Information — D. Risk Factors — Risks Relating to Ternium’s Business and Growth Strategy — Cybersecurity threats could have a material adverse effect on Ternium’s business and results of operations".
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | In addition, Ternium S.A. has established a management-level Critical Risk Committee (“CRC”) in connection with the monitoring, assessment and review of risks to which Ternium is exposed and in the oversight of the risk management framework and processes, with a focus on critical risks (including among them, cybersecurity risks), the development of mitigating actions, and the monitoring of action plans. |
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Under Ternium S.A.’s articles of association, as supplemented by the audit committee’s charter, the audit committee assists the board of directors in fulfilling its oversight responsibilities relating to the effectiveness of its systems of internal control, risk management and internal audit over financial reporting. |
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Under Ternium S.A.’s articles of association, as supplemented by the audit committee’s charter, the audit committee assists the board of directors in fulfilling its oversight responsibilities relating to the effectiveness of its systems of internal control, risk management and internal audit over financial reporting. |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Ternium S.A.’s board of directors receives quarterly reports from the Chief Executive Officer and the Chief Financial Officer on risk management, including cybersecurity risk management and relevant cybersecurity incidents. In addition, at least once a year, the Chief Information Officer reports to the board of directors on Ternium S.A.’s cybersecurity management. |
| Cybersecurity Risk Role of Management [Text Block] | In addition, Ternium S.A. has established a management-level Critical Risk Committee (“CRC”) in connection with the monitoring, assessment and review of risks to which Ternium is exposed and in the oversight of the risk management framework and processes, with a focus on critical risks (including among them, cybersecurity risks), the development of mitigating actions, and the monitoring of action plans. The CRC is composed of certain senior managers, including the Chief Information Officer, the Global Cybersecurity, Risk and Privacy Senior Director, the Chief Financial Officer and the Chief Executive Officer. The Chief Financial Officer oversees the risk management strategy. In particular with respect to cybersecurity risks, Ternium S.A. has appointed an Information Security Officer who is responsible for assessing cybersecurity risks and managing cybersecurity incidents, and reports to the Chief Information Officer, who, in turn, reports to the Chief Financial Officer. |
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The CRC is composed of certain senior managers, including the Chief Information Officer, the Global Cybersecurity, Risk and Privacy Senior Director, the Chief Financial Officer and the Chief Executive Officer. |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our Global Cybersecurity, Risk and Privacy Senior Director has been working on Ternium’s cybersecurity area since 2011. He holds a Bsc in Computing and Information Systems from Goldsmiths College, University of London, UK and professional certifications such as CISSP – Certified Information Systems Security Professional from ISC2 (International Information Systems Security Certification Consortium), CISA-Certified Information Systems Auditor, CGEIT-Certified in the Governance of Enterprise IT and CISM-Certified Information Security Manager from ISACA (Information Systems and Control Association).
|
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Chief Financial Officer oversees the risk management strategy. In particular with respect to cybersecurity risks, Ternium S.A. has appointed an Information Security Officer who is responsible for assessing cybersecurity risks and managing cybersecurity incidents, and reports to the Chief Information Officer, who, in turn, reports to the Chief Financial Officer. |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |