Company: BBD
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001292814-25-001244
Chunk: 330

Company: BANK BRADESCO
Filing Date: 2025-03-31
Form: 20-F
Item: Item 16
Chunk 330
---
 environment and developing and
implementing methodologies, models and tools for measurement and control of the risks. We promote the dissemination of a risk culture
to all employees, at all hierarchical levels, from the business areas to the Board of Directors.

We have deployed corporate
themes (risk management, crisis management, business continuity management, data processing) to the topic of cybersecurity risk, maintaining
a set of controls, represented by procedures, processes, organizational structures, policies, IT standards and solutions.

In addition, we adopt best
practices and market frameworks in processes, methodology in cybersecurity risk management, as well as prevention and treatment of information
security and cybersecurity incidents. To do so, the following activities are carried out: identification of threats, protection against
attacks, detection, responses and recovery from attacks.

  232 – Form 20-F 2024 | Bradesco  

  Table of Contents  

This corporate framework
and its developments are able to meet the principles of protection related to the confidentiality, availability and integrity of information.

The model of three lines
that we adopt to carry out the cybersecurity risk management steps is to identify, classify the risk and ensure that the responsible areas
plan and execute the assigned risk mitigation plans, so that essential management tasks are carried out in an integrated and coordinated
manner.

To ensure proper management
of cybersecurity risk, which allows adequately assessing risks and supporting managers and Senior Management in decision making, we are
grounded on the pillars of Information Security and Cybersecurity:

• Confidentiality: with proper classification, encryption, access
controls and segmentation of networks so that the right to read, copy and use the information is granted only when necessary and to
authorized people, protecting us from misuse or data leaks;

• Integrity: with proper authentication, traceability and data protection controls to ensure accuracy,
consistency and reliability of information, protecting our assets from malicious software or cyberattacks that cause data corruption,
alteration, or destruction; and

• Availability: with proper backup, contingency and redundancy procedures, so that business critical
processes can be executed properly, protecting our assets from cyberattacks that deplete the capacity of the technology infrastructure
and cause instability, deactivation, or unavailability of services.

We follow the above principles
to adopt best market practices in processes, methodology, and controls for identifying and managing cybersecurity risks, as well as preventing
and addressing information security and cyber incidents. To achieve this, we carry out the following activities:

We highlight the Assurance
SOC 2 Type II and SOC