Company: ADZCF
Filing Date: 2025-03-13
Form Type: 20-F
Source: 0001159508-25-000020
Chunk: 321

Company: DEUTSCHE BANK AKTIENGESELLSCHAFT
Filing Date: 2025-03-13
Form: 20-F
Chunk 321
---
 financial industry relevant risk scenarios. The thorough analysis comprises potentially affected stakeholders, including clients and suppliers, as well as the external threat landscape. The process considers contextual data and controls such as major events, threat assessments, findings, scenario analysis, control metrics, lessons learned, events at peer institutions, read across, regulatory expectations and remediation activities, when assessing control suites and residual risk positions. In case of emerging developments, additional risk reviews are conducted. The results are evaluated against the bank's control capabilities to cope with these risks. As part of the annual risk and control assessment process, internal security subject matter experts provide a risk evaluation, supportedby other areas such as Legal, Compliance or Group Data Privacy, as necessary. That evaluation is reviewed and challengedby risk subject matter experts to arrive at a final residual risk position. Additionally, senior information security experts from all divisions and functions assess the exposure of the group, based on their divisional or functional background. Those divisional and functional assessments are also reviewed and challenged by risk subject matter experts to arrive at a final residual risk position for divisions and functions. A comprehensive information security management system (ISMS) is crucial for an organization handling vast amounts of financial assets and sensitive data. In alignment with its Non-Financial Risk Management policies, Deutsche Bank’s globally applicable security policy framework defines the core principles of and the fundamentals for security management. The policy framework is reviewed annually, and any changes are approved by the CSO. It is governed centrally and applied globally across all product groups and business and infrastructure divisions. It also defines the roles, responsibilities, and accountabilities of key personnel identified to manage information security risk. The framework is aligned with the security strategy and sets out measures to manage and resolve information security breaches, and related communication procedures. The bank’s ISMS has been certified by an accredited certification body according to ISO 27001, for all information security domains defined within that standard since 2012. To maintain the ISO 27001 certification, the bank performs a full recertification process every three years, with the latest taking place in 2024. With the last recertification, Deutsche Bank upgraded its ISMS to the 2022 version of ISO 27001. Furthermore, the bank performs an annual surveillance audit designed to ensure compliance between the certification intervals.

| 99 |

| Deutsche Bank      |
| Annual Report 2024 |

Dependency on third-party products and services can expose the bank to cyber risks and impact its risk posture, as these can be prime targets for information security attacks.