Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Jun. 30, 2026 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Harmony’s cybersecurity governance employs a comprehensive and integrated approach to risk management, engaging both internal teams and third-party service providers. Harmony has established protocols for continuous monitoring and proactive management of cybersecurity threats through daily and weekly meetings and continuous interactions with its 24/7 outsourced Security Operations Centre (“SOC”). The SOC regularly engages with Harmony’s internal cybersecurity team to address identified threats and vulnerabilities. Harmony’s strategy includes monthly cross-departmental management meetings where cyber risk is discussed. External penetration tests and internal phishing simulations are conducted bi-annually to evaluate and enhance incident response capabilities and employee awareness. Cyber incident response plans are documented including detailed playbooks designed to enable timely response and recovery in the event of a cyber incident. Cybersecurity processes are fully integrated into Harmony's broader enterprise risk management system. The continuous engagement between Harmony’s internal cybersecurity team, technology stakeholders, and the SOC underscores Harmony’s comprehensive approach to risk assessment and mitigation. The head of the department for cybersecurity (''Manager: CyberSecurity''), meets with the Group chief technology and information officer (“GCTIO”) on a weekly basis. In addition, quarterly technology and information systems steering committee meetings include representatives from Group internal audit, enterprise risk management, security, operations, safety, and compliance. Harmony routinely engages third parties in its cybersecurity operations. These engagements include: •Consulting with external experts to provide specialised cybersecurity services, including penetration testing. •Utilising an internal training platform to deliver and monitor cyber awareness training modules ensuring employees remain current on best practices. •Collaborating with operational technology to address specific cybersecurity challenges in operational environments. •Outsourcing its SOC to a managed service provider that operates continuously, providing round-the-clock monitoring and response to cybersecurity threats. •Periodic reviews are also conducted by Group Internal Audit using the National Institute of Standards and Technology framework (''NIST framework") and the Center for Internet Security Framework ("CIS framework") as benchmarks to assess cybersecurity readiness. Harmony engages with vendors that have access to its network, requiring their compliance with Harmony's Cybersecurity Awareness Training mandate. This initiative emphasises the completion of training campaigns and awareness of key cyber risks, such as phishing. Harmony has also introduced a process to include cybersecurity clauses in all new vendor contracts to ensure service level agreements, roles and responsibilities for managing cyber threats are clearly defined. For existing contracts, these clauses are incorporated upon amendment or renewal. This initiative is part of a broader effort to embed Harmony’s cybersecurity standards into all third-party relationships.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Harmony’s cybersecurity governance employs a comprehensive and integrated approach to risk management, engaging both internal teams and third-party service providers. Harmony has established protocols for continuous monitoring and proactive management of cybersecurity threats through daily and weekly meetings and continuous interactions with its 24/7 outsourced Security Operations Centre (“SOC”). The SOC regularly engages with Harmony’s internal cybersecurity team to address identified threats and vulnerabilities. Harmony’s strategy includes monthly cross-departmental management meetings where cyber risk is discussed. External penetration tests and internal phishing simulations are conducted bi-annually to evaluate and enhance incident response capabilities and employee awareness. Cyber incident response plans are documented including detailed playbooks designed to enable timely response and recovery in the event of a cyber incident. Cybersecurity processes are fully integrated into Harmony's broader enterprise risk management system. The continuous engagement between Harmony’s internal cybersecurity team, technology stakeholders, and the SOC underscores Harmony’s comprehensive approach to risk assessment and mitigation. The head of the department for cybersecurity (''Manager: CyberSecurity''), meets with the Group chief technology and information officer (“GCTIO”) on a weekly basis. In addition, quarterly technology and information systems steering committee meetings include representatives from Group internal audit, enterprise risk management, security, operations, safety, and compliance. Harmony routinely engages third parties in its cybersecurity operations. These engagements include: •Consulting with external experts to provide specialised cybersecurity services, including penetration testing. •Utilising an internal training platform to deliver and monitor cyber awareness training modules ensuring employees remain current on best practices. •Collaborating with operational technology to address specific cybersecurity challenges in operational environments. •Outsourcing its SOC to a managed service provider that operates continuously, providing round-the-clock monitoring and response to cybersecurity threats. •Periodic reviews are also conducted by Group Internal Audit using the National Institute of Standards and Technology framework (''NIST framework") and the Center for Internet Security Framework ("CIS framework") as benchmarks to assess cybersecurity readiness. Harmony engages with vendors that have access to its network, requiring their compliance with Harmony's Cybersecurity Awareness Training mandate. This initiative emphasises the completion of training campaigns and awareness of key cyber risks, such as phishing. Harmony has also introduced a process to include cybersecurity clauses in all new vendor contracts to ensure service level agreements, roles and responsibilities for managing cyber threats are clearly defined. For existing contracts, these clauses are incorporated upon amendment or renewal. This initiative is part of a broader effort to embed Harmony’s cybersecurity standards into all third-party relationships. Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management, including the GCTIO, the Manager: Cybersecurity and various management committees, such as the enterprise architecture, change/project delivery, and technology steering committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group technology strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides regular updates to the GCTIO during weekly one-on-one meetings and monthly Group technology management committee sessions. This structured communication flow enables the GCTIO to provide updates to the executive committee and the audit and risk committee. Group enterprise risk management and Group internal audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group internal audit, Group risk management, security and compliance participate in quarterly technology and information steering committee meetings. From a disclosure perspective, the executive committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | As of the date hereof, Harmony is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operations or financial condition. Harmony continually assesses and monitors threats and vulnerabilities.
|
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Board Oversight Harmony has established mechanisms to ensure that both the board of directors and the audit and risk committee are regularly informed of cybersecurity threats and the measures taken to address them. The GCTIO, supported by the Manager: Cybersecurity, provides regular updates to these bodies, including discussions of material cybersecurity incidents, vulnerabilities, defences, and planned response strategies. The GCTIO attends audit and risk committee meetings and reports back any feedback or recommendations to management. Together, the GCTIO and the Manager: Cybersecurity ensure that material cyber risks are appropriately escalated to the board via the audit and risk committee. Additionally, the chief audit executive, whose mandate includes cybersecurity, maintains a direct reporting line to both the audit and risk committee and the chairperson of the board, providing multiple channels for oversight and assurance.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Harmony has established mechanisms to ensure that both the board of directors and the audit and risk committee are regularly informed of cybersecurity threats and the measures taken to address them. The GCTIO, supported by the Manager: Cybersecurity, provides regular updates to these bodies, including discussions of material cybersecurity incidents, vulnerabilities, defences, and planned response strategies. The GCTIO attends audit and risk committee meetings and reports back any feedback or recommendations to management. Together, the GCTIO and the Manager: Cybersecurity ensure that material cyber risks are appropriately escalated to the board via the audit and risk committee. Additionally, the chief audit executive, whose mandate includes cybersecurity, maintains a direct reporting line to both the audit and risk committee and the chairperson of the board, providing multiple channels for oversight and assurance.
|
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Harmony has established mechanisms to ensure that both the board of directors and the audit and risk committee are regularly informed of cybersecurity threats and the measures taken to address them. The GCTIO, supported by the Manager: Cybersecurity, provides regular updates to these bodies, including discussions of material cybersecurity incidents, vulnerabilities, defences, and planned response strategies. The GCTIO attends audit and risk committee meetings and reports back any feedback or recommendations to management. Together, the GCTIO and the Manager: Cybersecurity ensure that material cyber risks are appropriately escalated to the board via the audit and risk committee. Additionally, the chief audit executive, whose mandate includes cybersecurity, maintains a direct reporting line to both the audit and risk committee and the chairperson of the board, providing multiple channels for oversight and assurance.
|
| Cybersecurity Risk Role of Management [Text Block] | Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management, including the GCTIO, the Manager: Cybersecurity and various management committees, such as the enterprise architecture, change/project delivery, and technology steering committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group technology strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides regular updates to the GCTIO during weekly one-on-one meetings and monthly Group technology management committee sessions. This structured communication flow enables the GCTIO to provide updates to the executive committee and the audit and risk committee. Group enterprise risk management and Group internal audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group internal audit, Group risk management, security and compliance participate in quarterly technology and information steering committee meetings. From a disclosure perspective, the executive committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management, including the GCTIO, the Manager: Cybersecurity and various management committees, such as the enterprise architecture, change/project delivery, and technology steering committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group technology strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides regular updates to the GCTIO during weekly one-on-one meetings and monthly Group technology management committee sessions. This structured communication flow enables the GCTIO to provide updates to the executive committee and the audit and risk committee. Group enterprise risk management and Group internal audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group internal audit, Group risk management, security and compliance participate in quarterly technology and information steering committee meetings. From a disclosure perspective, the executive committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Dr Hendrik Kotze – Group CTIO B Com (Commercial Computer Science) - University of Pretoria MBA International Business Doctor of Philosophy – Kairos University, USA The GCTIO is responsible for managing the entire technology infrastructure of Harmony, including hardware, software, networks, and data centres, ensuring that these systems are reliable, secure, and scalable to meet the organisation's evolving needs. Stanley Pautz – Manager: Cybersecurity B Com (Internal Audit), University of Pretoria Certified Information Systems Auditor - ISACA Certified in Risk and Information Systems Control - ISACA CIA – Certified Internal Auditor (IIA – not maintained) The Manager: Cybersecurity ensures that the entire technology landscape is overseen, secure and safe in line with the business and technology strategies. Dr Christiaan Roos – Lead: Cybersecurity operations D Com (PhD), IT Audit, IT Governance and Ethical Hacking, University of Johannesburg CEH – Certified Ethical Hacker Project Management Professional (PMP), Project Management Institute Dr Roos was contracted as virtual chief information security officer of Harmony with effect from 1 March 2021.
|
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Governance Harmony has established governance procedures to manage cybersecurity threats. Senior management, including the GCTIO, the Manager: Cybersecurity and various management committees, such as the enterprise architecture, change/project delivery, and technology steering committees, are responsible for assessing cybersecurity risks and formulating mitigation strategies. These forums align with the Group technology strategy to ensure a coordinated and consistent approach. The GCTIO is accountable for Harmony’s technology and information functions, while the Manager: Cybersecurity leads the cybersecurity strategy and related initiatives. Harmony also engages external legal counsel to provide specialised advice on cybersecurity compliance and risk management. This combination of internal and external expertise ensures proactive oversight and continuous improvement of the cybersecurity framework. Structured reporting and communication processes ensure that management remains informed on cybersecurity matters, including threat prevention, detection, mitigation and remediation. The Manager: Cybersecurity provides regular updates to the GCTIO during weekly one-on-one meetings and monthly Group technology management committee sessions. This structured communication flow enables the GCTIO to provide updates to the executive committee and the audit and risk committee. Group enterprise risk management and Group internal audit have incorporated cybersecurity within their mandates, reinforcing its importance across the organisation. Representatives from Group internal audit, Group risk management, security and compliance participate in quarterly technology and information steering committee meetings. From a disclosure perspective, the executive committee assesses the materiality of reported cybersecurity incidents in accordance with applicable disclosure standards.
|
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |