Company: BBD
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001292814-25-001244
Chunk: 332

Company: BANK BRADESCO
Filing Date: 2025-03-31
Form: 20-F
Item: Item 16
Chunk 332
---
27005:2018 - Information Security Risk Management, NIST Cybersecurity Framework - NIST CSF (Guide for Improving Critical Infrastructure
Cybersecurity) and the Information Security Forum (ISF) for the development of an internal model of cybersecurity risk assessment.

Information security and
cyber incidents are categorized according to the severity assigned, as defined in the “ Information Security and Cyber Incident
Severity Matrix”, considering the following potential impacts: to clients, employees and other stakeholders; financial; regulatory;
reputation-related; availability of systems or services; and, the privacy of data subjects.

16. K.50 Hiring evaluators,
consultants, auditors or other third parties in connection with any such cyber risk processes

We also engage an independentthird partyto audit our ISAE 3402 compliance, in addition to the ISO/IEC 9001, 27001/2 Certifications.

16. K.50-01 Hiring Relevant
Service Providers

We hire relevant data processing
and storage services and cloud computing according to our internal governance and regulatory compliance policies criteria, containing
specific requirements to contract these services and avoid compromising the confidentiality, integrity and availability of information.

Before hiring the services,
we carried out a security assessment of vendors who provide services, listed our hiring process. The process is eliminatory, all procedures
and checks are documented, and contracts provide for specific clauses as set out in CMN Resolution No. 4,893/21.

The cybersecurity risk in
relevant service providers is classified, in the corporate risk library, as “ Very High”, due to the concern and the need for
visibility and monitoring of the environment of these providers, being supervised at the highest strategic levels, such as Audit and Risks
Committees.

We reinforce the importance
of the subject throughout the Group, through several communications and Workshops on Information Security with Contract managers, covering
the correct classification of the service, as well as to ensure compliance with Resolution CMN No. 4,893/21 and LGPD. In addition, we
also emphasized the importance of the subject to our suppliers during the assessment the importance of commitment to the evaluation process
conducted by the area of Information Security for third parties (SIT).

16. K.50-02 Risks of cybersecurity
threats

For more information on
cybersecurity threat risks, see “ Item 3. D. Risk Factors - 3. D.20.09 Cybersecurity Risk”.

  234 – Form 20-F