Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 350

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 350
---
 and testing providers in a small group of main industry-leading suppliers, thus requiring a greater level of supplier control and monitoring and the need for special oversight and adjustment throughout 2023 and 2024, reducing with this small number of leading providers the likelihood of experiencing cybersecurity incidents in this area. In order to holistically and adequately manage all risks related to technology and data, the Institution classifies these risks into eight categories, in line with the Guidelines on ICT and security risk management (EBA/GL/2019/04):

| – | IT security (cybersecurity): risk of unauthorised access to IT systems, and of there being an impact on the                                                                                                                    
 confidentiality, availability, integrity and traceability of the information (data and metadata) that they contain (including cyberattacks and deliberate action), as well as the potential repudiation of digital operations. |

| – | IT availability (technological resilience): risk of critical services provided to customers and employees becoming 
 affected by systems failures.                                                                                      |

| – | IT outsourcing: risk that engaging a third party, its management or related IT services produces a negative effect on     
 the Institution’s performance (including impacts on customers, as well as reputational, regulatory or financial impacts). |

| – | IT change: risk arising from the inability of the organisation to manage IT system changes in a timely and controlled                                                                                                                                   
 manner, in particular for large and complex change programmes that could potentially impact the availability and/or confidentiality of information or which could result in a failure to meet the business expectations that prompted those changes. In 
 addition, the continued use of obsolete IT systems, without the required upgrades, could jeopardise the IT activities of the organisation or the execution of strategic programmes with a strong IT component (e.g. digital transformation programmes). |

| – | IT data integrity: risk of the data stored and processed by IT systems being incomplete, inaccurate or inconsistent                                                                                                                                      
 across different IT systems, for example as a result of weak or absent IT controls during the different phases of the IT data life cycle (i.e. designing the data architecture, building the data model and/or data dictionaries, verifying data inputs, 
 controlling data extractions, transfers and processing, including rendered data outputs), impairing the ability to provide services and produce (risk) management and financial information in a correct and timely manner.                              |

| – | IT governance: risk arising from inadequate or insufficient management and use of technology, as well as a poor 
 alignment of these technologies and their intended uses with the business strategy