Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 499

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 499
---
Technological infrastructure

Santander has a network of high-quality data processing centres (CPDs) interconnected by a redundant communications system. They are spread across strategic markets to support and develop our operations. They combine traditional IT systems with the capabilities of a private, on-premise cloud, which, thanks to its swift adoption, enables us to integrate management of the business areas’ technology, accelerate digitalization and achieve significant cost savings.

Santander has migrated more than 96% of its technology infrastructure to the cloud and has accelerated the deployment of next generation infrastructure in the on-premise private cloud with a technology architecture that provides greater resilience and efficiency while reducing energy consumption.

Our local Cloud Centres of Excellence (CCoEs), coordinated by Global CCoE, guarantee consistent and rigorous cloud adoption across our entities. This minimizes risk in accordance with our public cloud policy. Migration will also contribute towards Santander's sustainable banking goals as we have reduced our carbon footprint by 32 tonnes.

Cybersecurity

Cybersecurity is crucial in supporting our purpose of helping people and businesses prosper and to become the best open financial services platform. Both the digital evolution, driven by the boom in connectivity and emerging technologies, as well as the complex cyber threat landscape, continue to make cybersecurity a business risk and a priority for the Group.

In 2024, the Group continued to strengthen its cyber defences in an effort to mitigate the risks associated with the current environment, which is marked by increased geopolitical tensions and the accelerating adoption of emerging technologies such as artificial intelligence. As a result, new controls have been implemented to address current risk areas and new attack methods. Among these, security controls were strengthened, focusing on ransomware and distributed denial of service (DDoS) preparedness and response, access management in virtual environments, supply chain protection, and the incorporation of measures to prevent digital fraud and identity theft, ensuring a more secure customer experience. To ensure alignment with the cybersecurity requirements set out in the Digital Operational Resilience Act (DORA), regulation that aims to strengthen IT security of financial entities, we also reviewed and adapted internal regulations with a focus on incident management and reporting and advanced penetration testing.

To manage the environment with increasingly complex threats and the rapidly transforming digital landscape that means a continually expanding attack surface, Santander has updated its cybersecurity strategy, which focuses on three pillars:

• Shift-left. Embedding security by default is key to help identify and mitigate cybersecurity risks from the earliest stages of initiatives. It is essential to have a culture where security is our priority as