Company: ADZCF
Filing Date: 2025-03-13
Form Type: 20-F
Source: 0001159508-25-000020
Chunk: 322

Company: DEUTSCHE BANK AKTIENGESELLSCHAFT
Filing Date: 2025-03-13
Form: 20-F
Chunk 322
---
 Third-party information security risks are managed by Deutsche Bank through a combination of capabilities, implementing a comprehensive approach to mitigate these risks and cover regulatory requirements (incl. the EU DORA regulation). Key components include the bank’s global third-party risk management program, which is designed to identify, monitor, and mitigate risks associated with third-party engagements. In combination, the bank demands adherence to an information security policy with specific control objectives for third parties, which include incident notification requirements. To ensure adherence, the information security posture of the third parties is reevaluated on a periodic basis (defined by the criticality of the vendor). In response to specific threats and incidents, proactive engagement and outreach with these parties is taking place. This is complemented by security assessments, which also include onsite assessments of third parties. These measures collectively contribute to the bank’s oversight and support that third-party services align with the bank’s security requirements. Actions and resources To address the evolving threat landscape, Deutsche Bank has a variety of prevention methods and controls in place. These include, for example, network security, identity and access management, endpoint and data security (including data classification and leakage prevention), threat intelligence, cyber hygiene, and encryption solutions. Those preventive controls are backed by a threat-driven detection set-up and a robust incident-response process. The bank continually reviews and enhances its information security controls through multiple layers of technology, including databases, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to strengthen the end-to-end protection by utilizing multiple opportunities to detect, prevent, respond to, and recover from cyber threats. Deutsche Bank employs various mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. Deutsche Bank´s independent Group Audit function is mandated to regularly assess security controls as part of their audit plan. Furthermore, the regular annual audit conducted by the bank´s external auditor considers identity and access management controls. The overall information security program of the bank is evaluated on a regular basis by third-party organizations. The bank actively shares security best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help ensure that the bank’s security technology and procedures reflect current financial industry’s best practices and keep pace with the threat environment.

| 100 |

| Deutsche Bank      |
| Annual Report 2024 |

As digitalization advances, the need to enhance literacy on information security topics grows. Deutsche Bank addresses this by educating and informing clients through