We focus on prevention to counteract risks. The first line of defense at HOCHTIEF is security by design. This means the use of technical measures where the implementation process ensures a safe working environment on the basis of system design or configuration. Where recourse is made to organizational measures, these are subject to structured, documented procedures backed up with checks and balances. The measures are flanked by technical analysis systems.

Employee training on cybersecurity is also geared to common and current threats.

Lessons learned from emerging developments are continuously incorporated into security objectives and/or the Information Security Policy.

Initiatives implemented throughout the Group in the reporting year to protect against cybersecurity risks include the following:

• Structured requirements management processes including the management of information security risks (check list, involvement of specified departments, risk assessment, etc.)
• Internal phishing campaign to identify specific action such as a need for employee training
• Automated and manual penetration tests to detect security vulnerability in Internet-facing systems
• Mandatory training for all employees on general information security topics, plus ad-hoc information in the form of newsletters and intranet articles on current threats
• Continuous automated detection of vulnerabilities in Internet-facing systems, with reporting to support structured response processes
• Patch management on the basis of structured technical and organizational processes
• Attack detection and tracking solutions in operation
• Attack surface minimization by using technical measures for global blocking of entry points
• Use of technical means to minimize access to recognized and permitted systems or identities (for example, conditional access or MFA)
• Assessment of cybersecurity risks extended to include business-critical suppliers and business partners
• Structured reporting of business-critical security incidents

The reduction targets are science-based, align with the 1.5 degree target under the Paris Climate Agreement and the requirements of the Science Based Targets initiative (SBTi), and have been formally adopted by the HOCHTIEF Executive Board.

Following on from the annual reporting of our Scope 1 and 2 as well as selected Scope 3 emissions, we devised and rolled out the HOCHTIEF Sustainability Plan 2025 Group-wide in 2022. In this plan, alongside targets for all ESG dimensions, we notably formulated our climate targets and consolidated our Group-wide commitment to climate neutrality (net zero) by 2045. The reduction targets are science-based, align with the 1.5 degree target under the Paris Climate Agreement and the requirements of the Science Based Targets initiative (SBTi), and have been formally adopted by the HOCHTIEF Executive Board.

This analysis revealed no material locked-in greenhouse gas emissions from key HOCHTIEF assets and products that may jeopardize the attainment of our emission reduction targets or drive transition risks. We deliver projects to our clients largely in the capacity of managing contractor, meaning that we have neither major assets nor products with material locked-in emissions.

For HOCHTIEF, climate change has long been a fundamental and central focus in its Group-wide environmental sustainability strategy. We plan to expand this strategic focus with the aim of making all our business activities climate-neutral in the long term (for further information, please refer to HOCHTIEF’s GHG reduction targets), and with the goal of supporting our clients through our projects in successfully adapting to climate change. To this end, HOCHTIEF has gathered data on greenhouse gases for over ten years and worked continuously on methodically improving Group-wide coverage, accuracy, and tracking in order to facilitate avoiding and effectively managing GHG emissions in all activities.

The reduction targets are science-based, align with the 1.5 degree target under the Paris Climate Agreement and the requirements of the Science Based Targets initiative (SBTi), and have been formally adopted by the HOCHTIEF Executive Board.

For HOCHTIEF, climate change has long been a fundamental and central focus in its Group-wide environmental sustainability strategy. The company aims to expand this strategic focus with the goal of supporting clients through projects in successfully adapting to climate change. HOCHTIEF has gathered data on greenhouse gases for over ten years and worked continuously on methodically improving Group-wide coverage, accuracy, and tracking to facilitate avoiding and effectively managing GHG emissions in all activities. These activities are enshrined in HOCHTIEF's position paper on climate change mitigation and adaptation and its transition plan for climate change mitigation (Net Zero Roadmap). The position paper on climate change mitigation and adaptation was coordinated with all operational units and applies Group-wide.

The actions in the transition plan can be thematically assigned to four main decarbonization levers: Cooperation with Clients and Partners, Low emission construction materials, Increasing Efficiency and Effectivity, and Renewable Energy. These actions address HOCHTIEF’s main emission sources and pave the way for continuous reduction of GHG emissions in all scope categories. Responsibility for implementation lies with the operational units, and progress is tracked against targets. The actions extend across all business activities and apply to all operating regions.

Collaboration with clients and business partners is essential for implementing sustainability measures. This includes proposing project-specific, low-emission solutions, promoting sustainable design, and increasing the proportion of projects with early contractor involvement. The collaboration drives the transformation of the construction and infrastructure sector toward greater sustainability. Measures include promotion of sustainable design, circular design, project certification, and sustainable travel solutions.

The actions in the transition plan are implemented in close collaboration with clients and stakeholders, with responsibility lying with operational units. Progress is tracked against targets, and continuous adjustments are anticipated due to market innovations and regulatory requirements. The actions apply to all business activities and regions.