Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1088

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1088
---
,553 |                   |        | 21,840 |              |     | 11,476,393 |                    | 0.076 | % |     |                                   |           | 2,974,299 |          |   |

(A)Includes family shares.

13.7. Unresolved staff comments

None .

| 971 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

13.8. Cybersecurity risk management

At Santander, cybersecurity risk management is an integral part of our operational risk management and control model. Our cybersecurity risk management is designed to align with international best practices and provide a framework to measure and monitor our cybersecurity risk profile and control environment, including threats and incidents associated with the use of third-party service providers through our supplier risk management model and internal control framework, and facilitate coordination across different departments of the Group. Our operational risk model, where cybersecurity risk is embedded, establishes the items designed to manage and control operational risk properly according to legal and regulatory standards and best management practices. Its phases are: (i) strategic planning; (ii) identification and assessment of risks and internal controls; (iii) ongoing monitoring of the operational risk profile; and (iv) risk response decisions, including risk mitigation and risk transfer measures. Our model also covers reporting and escalation of relevant operational risk events, including cybersecurity risk, to senior risk executives in a timely manner. Operational risk control self-assessment (RCSA) is one of our main operational risk tools. It integrates specific reviews that allow for the identification of cybersecurity, technology, fraud, and third-party supplier risks as well as other risk drivers that could lead to operational risk or failure to meet legal or regulatory expectations. RCSA is implemented in Heracles, which is our management and reporting system for operational risk throughout the Group, supporting our operational risk programme and tools with a governance, risk and compliance (GRC) approach. In 2024, in light of an increase in cybersecurity and environmental related risks, as well as legal and regulatory requirements (including DORA in particular), we have strengthened our third-party supplier risk management model and internal control framework and we also have developed various tools designed to assess, manage and control risks throughout the management cycle including the risks in outsourcing and third-party agreements. Our security controls have been strengthened in an effort to mitigate the risks associated with the current environment, characterized by increasing geopolitical tensions and the accelerated adoption of emerging technologies