Company: BBD
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001292814-25-001244
Chunk: 331

Company: BANK BRADESCO
Filing Date: 2025-03-31
Form: 20-F
Item: Item 16
Chunk 331
---
 3, issued by independent specialized audit, which is renewed every year. This assurance confirmed the consistency
and effectiveness of the controls implemented for IT environment security, regarding financial services provided, based on international
standard information security controls (AICPA - Association of International Certified Professional Accountants) and SOC 2 service
categories: security, availability, processing integrity, confidentiality and privacy of data.

The cybersecurity process
consists of the following activities:

• Identification of Threats: detect and identify threats and vulnerabilities, identify and evaluate
risks, and define potential scenarios that may affect our cyber environment. This stage also includes the continuous monitoring of governance
indicators that contribute to improve the identification of trends and anticipate possible incidents;

• Protection Against Attacks: perform preventive actions to mitigate or transfer cybersecurity risk
and safeguard critical assets such as information and cybersecurity awareness and training, as well as implement security updates, virus
protection, malicious files and software, managed and updated periodically;

• Detection of Attacks: monitor and identify in a timely manner risk materialized in attacks or information
leaks, with monitoring tools and investigation processes that give knowledge to those responsible for actions of response; and

• Response and Recovery from Attacks: keep a record of incidents, analyze the origin and effects
of relevant incidents, duly detail actions in specific Incident Management regulations, defining the criticality assessment, assignment
of the responsible people and expected action to contain the incident, restore assets and mitigate impacts as well
as guide actions to be taken post-incident to subsidize decision-making that avoids the occurrence of other similar attacks.

  233 – Form 20-F 2024 | Bradesco  

  Table of Contents  

We use different paths in
order to comply with CMN Resolution No. 4,893/21, such as corporate policies and regulations, which are reviewed every year, training
and awareness activities related to information and cyber security, communication of threats and incidents to stakeholders, management
process of Information Security and Cybernetic indicators, issuing of the annual cybersecurity report, as well as independent and periodic
effectiveness tests carried out in key controls for monitoring cybersecurity risk.

Issues related to cybersecurity
risk events are reported on a timely and periodic basis in our risk control forums, including effective communication to stakeholders.

16. K.40 Methodology to measure
cybersecurity risk

We use internal and external
sources of information to assess new types of threats, vulnerabilities and cyberattacks, as well as market standards, such as ISO/IEC