Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1089

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1089
---
 such as AI. We also implemented new controls designed to address current risk areas and emerging attack methods. These include ransomware and Distributed Denial of Service (DDoS) preparedness and response, access management in virtual environments, supply chain protection, and the incorporation of measures designed to prevent digital fraud and identity theft, all of which are designed to provide a more secure customer experience. Internal policies and procedures have also been reviewed and adapted in an effort to ensure alignment with the cybersecurity requirements set out in DORA, with a focus on incident management and reporting, and advanced penetration testing. The Santander Fusion Center, which integrates the cybersecurity and IT monitoring teams, carries out the functions of detection, monitoring and response to operational failures and cybersecurity events for the Group's entities, 24 hours a day and seven days a week. In addition to regular testing and reviews performed by our cybersecurity team, independent third-party certification authorities review and certify our critical cybersecurity processes and controls. Certifications are periodically

reviewed and updated, and new processes and controls are certified on an annual basis. For information on our overall risk management process and tools, and risk reporting structure, see sections 1.3 ‘Risk and compliance governance’ and 1.4 ‘Risk management processes and tools’ in the ‘Risk management and compliance’ chapter in Part 1 of this annual report on Form 20-F. For details on the measurement, monitoring and control of cybersecurity-related risks, and their respective mitigation plans, and cybersecurity initiatives, see 5. ‘ Research, development, and innovation (R&D&I) - Cybersecurity’ in the ‘Economic and financial review’ chapter and 5.2 ‘Operational risk management (including Cyber risk)’ in the ‘Risk management and compliance ’ chapter of this annual report on Form 20-F. For more details on the cybersecurity initiatives, including training and awareness we ran in 2024, see 3.3.3. ‘Privacy, data protection and cybersecurity’ in the ‘Sustainability statement’ chapter of this annual report on Form 20-F.

The board of directors and its delegated committees are the highest decision-making and monitoring bodies regarding management of cybersecurity risk. The innovation and technology committee of the board of directors is in charge of assisting the board with the supervision of cybersecurity risks in coordination with the risk supervision, regulation and compliance committee and the audit committee. The three committees are jointly responsible for monitoring the cybersecurity strategy of the Group and the internal audit coverage of cybersecurity risk and overseeing management's management and control of cybersecurity