Company: BBVXF
Filing Date: 2025-02-21
Form Type: 20-F
Source: 0000842180-25-000010
Chunk: 314

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-21
Form: 20-F
Item: Item 16K
Chunk 314
---
 accepted security standards. It covers best practices established in information-security standards and guidelines including ISO/IEC 27002 and other ISO/IEC 27000 series standards, COBIT 5 and the NIST Cybersecurity Framework.
BBVA has also obtained several security certifications (such as Tier IV and ISAE 3402 certifications) in different countries. To maintain these certifications, periodic external audits are performed, considering the specific requirements of each certification. The external auditors that perform these audits are selected from among the most recognized audit firms in the areas of each certification.
Considering that one of the main risks companies face today are risks related to third parties, BBVA reinforced its controls to ensure an adequate protection of information by BBVA’s service providers in 2024. BBVA requires that service providers contracted by any Group company have internationally accepted security certifications. Security clauses are also included in contracts with service providers, including obligations to comply with specific security measures and all applicable legal and regulatory requirements. The third parties risk management model has been reinforced during 2024 to comply with the requirements of new regulations entering into force, such as the Digital Operational Resilience Act (DORA) (see “Item 4. Information on the Company―Business Overview—Supervision and Regulation—Principal Markets—Spain”).
In 2024, we did not identify any cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “Item 3. Key Information—Risk Factors—Operational Risks—Attacks, failures or deficiencies in the Group’s procedures, systems and security or those of third parties to which the Group is exposed could have a material adverse effect on the Group’s business, financial condition and results of operations, and could harm its reputation”. 
Governance
Our Board of Directors has overall oversight responsibility for our risk management, and is assisted by the Board’s Technology and Cybersecurity Committee in the oversight of technological risk and cybersecurity management and in monitoring the Group’s technological and cybersecurity strategies. This Committee, which meets every two months, is one of the main elements of our risk management governance model. It is responsible for the oversight of the Group’s technological and cybersecurity strategies and is informed by the Chief Security Officer (“CSO”) of technological and cybersecurity performance and of any incidents that have arisen