Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 358

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 358
---
 many of which perform critical services for Barclays' businesses and handle sensitive Barclays data, we have a set of contractual Information and Cyber Security Supplier Control Obligations that are based on requirements in our internal Standards. Using our dedicated Third Party Security Management team’s capabilities, as well as third-party tooling, we conduct assurance over our third and fourth parties against those obligations. Activity is structured on a risk-based approach that prioritises suppliers that underpin our most important business services. Identified issues are managed formally, but we also engage proactively with third-party suppliers to help them strengthen their security and resilience posture. To recognise the risk presented by third-party suppliers, which are increasingly targeted by threat actors, we regularly alert third- party suppliers where we anticipate that they may be more vulnerable and should take preventative action. Notwithstanding such third-party risk management efforts, Barclays does not have direct control over the cybersecurity of the systems of its third and fourth parties, limiting the Group’s ability to effectively protect and defend against certain threats. Certifications Barclays holds three ISO27001 certifications (i.e., the international standard on how to manage information security), Cyber Essentials/Cyber Essentials Plus Certification, and a UK certification for Digital Banking . Training Barclays requires colleagues to complete mandatory information security training at least annually. Topics covered include incident reporting procedures, protecting sensitive data, device security, data leakage prevention, social engineering awareness, and password management. Consequences of non-completion may include disciplinary action and impact to compensation. Barclays performs a number of key activities related to identifying, investigating, responding to and containing phishing, including an operational process that provides education and awareness through phishing simulation exercises, and management interventions for employees who demonstrate susceptibility to phishing lures. To report suspected phishing to Barclays' JOCs for further investigation, colleagues have a reporting tool integrated into their email account and receive feedback on whether the reported email was suspect or genuine. Barclays uses metrics to continually refine its phishing education and training.

| Risk review                                                                                                                                                                                                                                                                                                          |                                                                                        |      |                |
| The management of risk is a critical underpinning tothe execution of Barclays’ strategy. The material risksand uncertainties the Group faces across itsbusiness and portfolios are key areas ofmanagement focus.                                                                                                     |                                                                                        |      |                |
|                                                                                                                                                                                                                                                                                                                      |                                                                                        | Page | Pillar 3Report |
| Risk management strategyOverview of Barclays’ approach to riskmanagement. A detailed overviewtogether with more specific informationon policies that the Group determinesto be of particular significance in thecurrent operating environment can befound in the Barclays