The Top Management is involved in the definition of an acceptable level of risk, through meetings of the Risk Committee focused on the results of annual information security risk assessment processes, which identify the most effective mitigation and security improvement initiatives, in the face of an increasing level of external threats, the implementation of which is constantly monitored.