Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1049

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1049
---
 rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators.

Federal banking regulators, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions. A financial institution is expected to establish a framework of internal control, first, second and third lines of defence, and risk management policies, procedures and processes that are designed to address the cyber risks that it faces in its business operations. A financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if the institution or its critical service providers fall victim to a cyberattack.

For example, in October 2016, federal banking regulators (namely, the Federal Reserve, FDIC and OCC) issued an advance notice of proposed rulemaking regarding enhanced cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including our US bank subsidiaries. The proposed standards would expand existing cybersecurity regulations and guidance to focus on cyber risk governance and management; management of internal and external dependencies; and incident response,

cyber resilience and situational awareness. In addition, the proposal contemplates more stringent standards for institutions with systems that are critical to the financial sector. Although in 2019 the FDIC and OCC each withdrew the advance notice of proposed rulemaking, the Federal Reserve has not withdrawn the advance notice and may still propose such a rule. Additionally, in September 2016, the Federal Financial Institutions Examination Council (FFIEC) issued an Information Security booklet, which includes guidelines for evaluating the adequacy of information security programs (including effective threat identification, assessment and monitoring, and incident identification assessment and response), assurance reports and testing of information security programs. The FFIEC also developed a Cybersecurity Assessment Tool in May 2017 to help financial institutions identify their risks and determine their preparedness for cybersecurity threats. In September 2022, the FFIEC also issued a Cybersecurity Resource Guide for Financial Institutions designed to help financial institutions meet their security control objectives and prepare to respond to cyber incidents, including ransomware incidents.

Further, in the spring of 2022, federal banking regulators imposed a new