Grupo Aeroméxico has established a cybersecurity position that consists in continuously carrying out risk assessments, with the aim of identifying vulnerabilities within the infrastructure, and thus be able to determine the security controls within the organization to be implemented.

The process of defining the cybersecurity position in Grupo Aeroméxico is a living and ongoing element, starting with determining the level of cybersecurity maturity within the organization, recognizing the security gaps that need to be corrected, as well as the efforts that need to be prioritized.

This process is aligned with the best practices and standards of information security such as – ISO/IEC 27001: 2013 Information Security Management System, ISO/IEC Information Security Risk Management 27005, ISO 31000 Risk Management. Risk Assessment Techniques, NIST Cyber Security Framework.

The Cybersecurity strategy at Grupo Aeroméxico is defined as an action plan, developed and implemented to help protect the confidentiality, integrity and availability (CIA) of data, as well as critical systems, information, assets and data. This strategy helps maintain the culture and minimum cybersecurity position, with the intention of preparing employees to react to a cyber-attack.

Grupo Aeroméxico’s Cybersecurity strategy is based on NIST CSF (Cyber Security Framework), which consists of five concurrent and continuous recommended functions. Identify, protect, detect, respond, and recover.

The Cybersecurity governance model at Grupo Aeroméxico is based on NIST SP 800-100. It is a process which objective is to establish and maintain a regulatory framework, a structure and management processes so that Cybersecurity strategies are aligned with the flight plan and, in turn, are consistent with applicable laws and regulations.

Training, awareness raising, skills development and best practices are critical elements of the Cybersecurity awareness program within Grupo Aeroméxico.

The objective of Training and Awareness within Grupo Aeroméxico is to provide its employees with sufficient knowledge to understand the cyber threats to which we are exposed, understand their responsibilities and how they should react when a cyber-attack occurs or may have occurred.

Those of us who collaborate with Grupo Aeroméxico, are convinced that relations among employees, with customers, partners, suppliers, stakeholders and society in general, must be carried out within a strict framework of ethical principles and corporate integrity.

In this context, we have developed and implemented regulations on ethics, integrity and the fight against corruption, in line with national and international practice, in compliance with the National Anti-Corruption System and other international regulations such as the FCPA, the UK Bribery Act, the Sarbanes Oxley Act. These achievements have been possible thanks to the evolution we have made in our corporate governance and business culture, which fosters honesty, security, transparency, and responsibility in all its activities.

As a result, this portal integrates the most relevant regulatory framework developed within our Compliance Program, which includes the Code of Conduct that sets forth the respect and integrity behavior that is expected amongst us and toward our customers and partners. You will also find regulations on matters such as anti-corruption, antitrust, conflict of interest and information security, among other products and tools of the Program.

Other information that you can consult on this site is related to actions in the field of social development, care for the environment and others that contribute to sustainable development.

In Grupo Aeroméxico, the human factor is the fundamental piece to be the company we are toward our customers and partners, so here you will also find various campaigns and tools related to the promotion of gender equality, non-discrimination and our commitment to human rights.

In the fight against corruption, we are all part of the great Aeroméxico crew, so in this space we share our Compliance Program that undoubtedly helps us to have the best flight for everyone.

Aeromexico always deals honestly with governments, business partners, and third parties in general, and complies with the applicable laws in all the jurisdictions where we have activities and manage our businesses. In that sense, Aeromexico has assumed the commitment to carry out its businesses ethically and respecting the law, enforcing the highest integrity standards and conforming to all the domestic and international laws and regulations applicable.

Pursuant to the fourth commitment set forth in our Code of Conduct, all the people who work in Aeromexico and its affiliates absolutely reject any act of corruption. This commitment represents an essential element for any honest, reliable, and competitive company in its business and labor relations and in its investments.

In accordance with what is stated in the Anti-corruption Policy of Aeromexico, any form of corruption, bribery, or fraud is strictly prohibited, regardless if the relevant third party is a public officer or any individual. We adhere to a zero-tolerance policy to corruption. Accordingly, Aeromexico will not approve nor will it be involved in any irregular or illegal payments or in undue benefits of any kind or in any circumstances whereby a third party could reasonably perceive that the purpose of the Company is to obtain or retain a business, influence on a business relation, or be linked to any inadequate performance of the tasks of the recipient.

Aeromexico will never accept the direct or indirect participation of any third party in any act of corruption or bribery.

All the operations that involve the resources or assets of Aeromexico or the operations made for and on behalf of Aeromexico by a third party must be recorded in time and with reasonable detail, accurately and completely, as evidence of their occurrence.

Anti-trust represents the effort made by two or more people, businesses, or companies to increase their market share, offering more options of products and services of higher quality at better prices.

The benefits of having anti-trust in the market are that it promotes fair and healthy competition, protects consumers, ensures the availability of higher quality goods at the lowest price possible, and promotes innovation.

Derived from the above and based on the importance of this matter for the wellbeing of our customers, Aeromexico is committed to promoting the compliance with the Federal Law of Anti-trust (Ley Federal de Competencia Económica). For this reason, it has the relevant policy that is communicated to the company staff, as well as an online-training course for the areas that require this knowledge for the tasks they perform.

In accordance with the third commitment set forth in our Code of Conduct, all the workers in Aeromexico share the responsibility to refrain from falling into situations that could result in regulatory non-compliance that affects the reputation of Grupo Aeromexico, and adopt an anti-trust culture as part of our values, strengthening the reputation, increasing productivity, and ensuring the long-term feasibility of the company.

With regards to the competition with other Economic Agents, we must use our best efforts to compete in an independent, strong, legal, and transparent way, so that the value contributed by our products and services becomes the differentiator that appeals and maintains our customers, observing at all times the business practices.

A conflict of interest implies an issue that emerges when the actions, relationships, interests, or investments of an executive or employee interfere or appear to interfere with those of Aeromexico or with the capacity to carry out its activities in an effective and impartial manner.

Pursuant to the second commitment set forth in our Code of Conduct, all the people who work in Aeromexico and its affiliates have the commitment to live with unshakeable integrity and be accountable of our actions.

In this sense, the main duties and obligations of any collaborator are:

1. Avoid operations, commitments, and activities that go against the interests of GAM or involve a conflict with his personal interests.
2. The obligation to refrain from involving in activities that could generate personal benefits and contravene the interests of GAM, and behave ethically at all times and following the highest standards of conduct.
3. Refrain from using money, items of value, assets, or facilities of the company for personal use.

Relatives who work at the same time in Group Aeromexico is allowed, however, to avoid potential conflicts of interest, they must not work in the same area and hiring family members of directors is forbidden.

The purpose of the conflict of interest policy is to establish the position of GAM in terms of conflicts of interest and ensure to the greatest extent possible that all the directors, officers, and employees are aware of and understand it, using the tools and guidelines established to fulfill these tasks and responsibilities.

Aeroméxico in its dealings with suppliers, service providers, intermediaries and business partners, seeks in its relevant relationships to verify adherence to the laws and best practices in matters of corporate integrity; therefore, we check all information provided by the third party itself, and perform background checks on sanctions and disqualification lists.

By monitoring our relationships with third parties, we help protect the Group's reputation, interests, property and rights, and we encourage our suppliers, service providers and business partners to improve their internal controls in order to avoid affecting their business commercial activities.

Under this policy, GAM collaborators must:

1. Identify if the relationship requires a background check process.
2. Apply any applicable questionnaires according to the type of relationship.
3. If any risk factor is found, inform the Legal Compliance Department to establish an acceptable mitigation strategy.

Through the monitoring of the relationship with Third Parties, the following activities are carried out: a) integration of a file; b) monitoring of changes; and c) timely reporting of breaches.