Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 354

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 354
---
 customers and clients, in line with our Standards, taking into account findings from internal and external reviews of our controls. Barclays seeks to protect the security of data we share with third parties, including by conducting remote and on-site inspections with certain suppliers to review their controls against contractual obligations and industry standards. A Third Party Service Provider Framework is in place which sets out control requirements for business units to manage the operational, reputational, conduct and legal risks to Barclays through its supply chain. In operating under a hybrid working model, we have continued to educate colleagues on cybersecurity risks in order to help minimise risks related to remote working, such as data exploitation or leakage. Barclays works with industry bodies and cybersecurity vendors to learn from risk events in other organisations. Our teams use such intelligence to simulate plausible cybersecurity and data compromise scenarios that allow us to exercise, review and improve our response and recovery plans in preparation for evolving threats. Operational resilience Customers and clients have increased expectations for us to be ‘Always On’. The interconnectivity of the financial sector means the stability and resilience of our systems, workforce and the continued provision of third-party services, all have a direct impact on the quality of our service. Resilience and security is a focus for the Board. Barclays continues to strengthen its resilience posture and is focused on its ability to recover from a range of ‘severe but plausible’ scenarios which could cause detriment to its customers and clients and the broader financial market. To enable this, we define Group-wide business services and their interdependencies across the Group, including technology, third-party services and our workforce. Recovery plans and business response plans have been developed for a range of different disruption events, such as cyber or data integrity disruptions, or technology failures. These recovery plans are reviewed and validated through regular testing which supports our aim to reduce the volume and impact of operational incidents year on year. We also conduct regular assurance on third parties to assess their capability. Operational resilience is delivered through an established and robust Operational Resilience Framework underpinned by a Policy, Standards, methodologies and procedures. These are integrated with Barclays’ Enterprise Risk Management Framework (ERMF) and set the tone from the top. The Standards are embedded within the Barclays Controls Framework and provide a consistent approach across the firm. The Operational Recovery Planning Policy and Standards drive the identification of the business services that are most important to Barclays, its customers, clients and the markets in which Barclays operates. The Standards also define requirements for setting recovery targets,

| Strategy                   | Shareholderinformation | Climate and sustainabilityreport |     | Risk review