Security, information security and privacy

| SAFETY

Due to the public health crisis provoked by the pandemic under way, various measures were in place in 2021 to fight and contain the spread of the virus, for instance: * taking passengers’ temperature via thermal scanners installed at

HS and IC departure train stations and handling suspected cases of infection in compliance with ruling legislation; * a new method for managing passenger flows in order to ensure social distancing (e.g., highly visible floor markings, creating specific paths using retractable belts); * providing specific devices for frontline station personnel (social distancing, personal protection devices, procedures for handling suspected cases of infection); * statistical/analytical monitoring of passenger traffic at large hubs where “Project Gate” is under way (Firenze Santa Maria Novella, Milano Centrale, Napoli Centrale and Roma Termini). The security and protection of personnel, passengers/users at stations, assets and know-how are essential for the Group.

INDICATOR SECURITY INDICATORS

2021 2020 2019 CHANGE % 2021/2020

Assaults on railway personnel 354 263 395 +34.6%

Thefts at the station 473 419 1,059 +12.9%

Thefts on board trains 1,356 1,175 2,692 +15.4%

Copper thefts from operating assets 171 138 254 +23.9%

Copper thefts at depots 10 11 18 -9.1%

Total

2,364 2,006 4,418 +17.8%

TREND % 2021/2020

The increase in the number of certain events is mainly due to the gradual resurgence of commercial services and passenger traffic in 2021.

The Group constantly invests to guarantee and monitor travel safety and the security of the infrastructure and stations. To monitor security indicators, the Group strengthened a partnership with the railway police (the branch officially responsible for preventing and repressing crimes in the railway sector). With respect to passenger security in 2021, the Group recorded the following: * 1,356 thefts suffered by passengers on board trains, significantly down on 2019, a year not impacted by reduced commercial services; * 473 thefts suffered by passengers at stations, up slightly by 12.8% on the previous year (2020: 419 thefts) due to the fact that

Covid-related restrictions led to a huge fall in numbers of passengers at stations. Compared to 2019, i.e., pre-pandemic figures, the numbers continue the positive trend recorded in recent years, with a 55.4% fall in the number of events recorded at national level.

The FS Italiane Group continues to pursue anti-mafia actions by adopting measures beyond those provided for by law and collaborating with the competent authorities in a structured manner in order to achieve effective results in repelling any attempts by organised crime to infiltrate intercompany contracts and sub-contracts. | CYBER SECURITY

The digitalisation of transport and mobility set off a process of human and industrial transformation of the entire sector. Widespread use of new technologies, such as blockchain, AI and IoT, will give the industry as a whole cognitive capacities that would have been unimaginable just a few years ago. As well as providing opportunities for developing a more efficient transport service portfolio, this new digital dimension could also enable cyber criminals to attempt cyber attacks to steal confidential information or block essential services, including acts of terrorism. Railway assets, trains, buses, stations, platforms, employee devices and suppliers’ IT systems will be increasingly more interconnected and the risk that just one of these assets be compromised and trigger a chain of effects generating inefficiencies in train circulation and impacts for customers cannot be excluded, nor is it acceptable. Cyber attacks are an inevitable side effect of digitalisation. Not only FS as an essential service operator, but the entire Italian system is obliged to acknowledge and contain such attacks.

The recent EU directive on NIS (network and information security) concerning cyber security, transposed into Italian legislation with decree no. 65 of 18 June 2018, identifies the FS Italiane Group as an essential service operator and, as such, requires that it adopt technical and organisational measures to strengthen management of cyber risks and prevent cyber attacks as part of a national and European model based on cooperation and the integration of information between member states.

Furthermore, the national cyber security scope was established with Legislative decree no. 105 of 21 September 2019. In addition to public entities, it includes private entities considered strategic operators whose protection is essential for the country to function. They are required to apply adequate technical and organisational security measures. Considering the legislative obligations and rapid evolution of security threats, the Group has adopted an integrated physical/cyber security steering and governance model in which physical security and cyber security converge under one command and control point, ensuring the adoption of general principles and consistent operating logic, to identify as quickly and reliably as possible the sources of a threat regardless of where it arises and irrespective of whether it is a physical, cyber or hybrid attack, in order to intervene immediately. The Group completed and launched the cyber security operation centre (C-SOC), a hub of excellence where state-of-the-art technological and human resources meet to identify, prevent, detect and fight cyber attacks. The C-SOC protects tens of thousands fixed and mobile group workstations throughout the country and the information systems supporting business processes and transport operation services harnessing the most innovative technologies on the market capable of exploiting the analytical potential of big data and AI to recognise and fight cyber attacks. A real time security monitoring system detects cyber threats in the network and business systems, active 24 hours a day, 365 days a year at the group’s C-SOC. In 2021, the team of security incident analysts detected, countered and neutralised over 4,000 cyber attacks.

The threat intelligence service plays a hugely significant preventative role in this regard. Expert analysts seek and detect new threats and specific attack routes in this complex preventative activity. They use technologies that can automate the gathering of information from certified channels, mainly institutional, and update the defence systems using links synchronised with the Group’s security devices. The threat intelligence service is also supported by an internal malware analysis team of specialists that can break down malware code and analyse its behaviour. This enables them to detect unknown threats and publish internal newsletters with Indicators of Compromise (IoC), or attack vectors that could impact all segments, and share them with institutions or other essential service providers. To boost resilience and meet the high standards of service security and continuity, the C-SOC set up a

“Lampertz room” dedicated to disaster & recovery and technologies for controlling operations remotely which allowed the analysts to operate fully remotely during the initial months of the public health emergency without any impact on operations or security. During the pandemic, the Cyber Security Unit, in collaboration with FS Technology, rapidly activated another remote access system to enable employees working from home to securely access company resources even using their own devices on an exceptional basis. The Group is also fully engaged in fighting fraud, and is a forerunner in its sector thanks to its fraud management system which uses specifically designed software for the railway sector. New monitoring methods designed to intercept fraud as swiftly as possible will be implemented in order to guarantee the best service to these and other international companies. The Company Security team continued to chair the international Colpolfer Fraud and ticket forgery working group in 2022 for international collaboration on ticket forgery. The group also rolled out a Travel Security model. Its main objectives are providing safety risk analysis, training, information and assistance to employees on work trips or international secondment. The travel security team analyses the security conditions of the country of destination to find the best measures to mitigate any risks and adjust security plans to handle any critical events in medium-high risk foreign countries. | DATA PROTECTION AND THE DATA PROTECTION OFFICER

The General Data Protection Regulation (“GDPR”) expands the protection of natural persons’ rights and freedoms in relation to their personal data, as these rights and freedoms have been recognised as fundamental for EU citizens. After the GDPR was introduced, the Ferrovie dello Stato Italiane Group designed and implemented an organisational framework to protect the data of its customers, employees, suppliers and other third parties. The data protection framework comprises a group measure and an organisational notice. It defines the key personal data protection principles, the roles and related macro-responsibilities and information flows to/ from the board of directors, senior management, the units involved in its creation and those involved in the processing of personal data, as well as the data subjects. In order to further safeguard data protection processes, Data protection officers were appointed at the main Group companies in 2021, thus adopting a distributed control model.