Company: BBVXF
Filing Date: 2025-02-21
Form Type: 20-F
Source: 0000842180-25-000010
Chunk: 315

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-21
Form: 20-F
Item: Item 16K
Chunk 315
---
. The Committee keeps the Board of Directors informed of the main technological and cybersecurity risks to which the Group is exposed, as well as current cybersecurity and technological trends and any relevant security event that can affect the BBVA Group. For a description of the functions of the Technology and Cybersecurity Committee, see “Item 6. Directors, Senior Management and Employees—Board Practices—Committees— Technology and Cybersecurity Committee”. 
The risk management process includes lines of action related to the adequate training of BBVA’s Board members in the area of cybersecurity and incident management, as well as the periodic performance of global and local simulation exercises in order to raise the level of training and awareness of the Board of Directors and certain key personnel and ensure an immediate and effective response in case of a security breach. 
Further, BBVA’s Corporate Security Area and the Risk Control Area, based in Madrid, are responsible for identifying and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CSO, who receives reports from our cybersecurity team (which is part of the Corporate Security Area) and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Both the Corporate Security Area and the Risk Control Area engage third-party security experts for risk assessments and system enhancements.
Our CSO and certain of the personnel of the Corporate Security Area have obtained internationally recognized certifications such as ISACA, Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Data Privacy Solutions Engineer (CDPSE), SANS Institute Certifications (GIAC Security Essentials, GIAC Certified Incident Handler Certification, GIAC Strategic Planning Policy and Leadership), Certified Information Systems Security Professional (CISSP) and ISO Certifications (ISO 27001 Lead Auditor), among others, and consist of experienced information systems security professionals and information security managers with the experience and capabilities required for their security functions. The CSO regularly reports to BBVA’s Internal Control & Operational Risk Committee on the Group’s cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports to them every two months that cover, among other topics, third-party assessments of the Group’s cybersecurity programs, developments in cybersecurity and updates to the Group’s cybersecurity programs and mitigation strategies.
PART III