Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 357

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 357
---
, Security Configuration, Data Loss Prevention, Vulnerability Management, Data Security, Incident Response & Threat Intelligence, Threat Management, Governance, Identity & Access Management, and Application Security. The Group CISO approves and is accountable for the Information and Cyber Security Policy and associated Standards. As part of our programme, we periodically assess our performance against these Standards and identify areas for improvement and remediation. The Board Risk Committee, within its oversight of Operational Risk as a Principal Risk, is responsible for overseeing risks arising from cybersecurity threats. In 2024, the Group Chief Security Officer and Group CISO provided updates to the Board Risk Committee about cybersecurity risks facing the Group. Such updates addressed topics that included the cybersecurity threat environment and ransomware attack preparedness, measurement of Barclays' risk and control posture, cybersecurity incident trends and Barclays' response, plans to improve Barclays' ability to recover from a material cyberattack scenario, Barclays’ vulnerability management, privileged access to Barclays' systems, regulatory developments, and risks and opportunities related to emerging technology and artificial intelligence . Engaging external security consultants to conduct penetration tests, attack simulations and other reviews to independently benchmark Barclays’ cybersecurity capabilities is an important part of our cybersecurity programme that allows us to identify and remediate cybersecurity weaknesses. In 2024, Barclays’ Group CISO and Group Chief Information Officer briefed the Board Risk Committee on plans to address the findings of penetration testing and cybersecurity assessments and remediate identified weaknesses. Barclays also partners with third-party security providers on certain activities such as cyber recovery, software vulnerability scanning, penetration testing, distributed denial of service (DDoS) attack prevention, phishing simulations, third- party risk management, incident response, intelligence, fraud prevention, and industry benchmarking. An important part of Barclays’ cybersecurity environment is its Joint Operations Centres (JOCs), which operate 24x7x365 from three globally strategic locations, linking Barclays’ security professionals and incident response managers with control functions and business unit representatives. The JOCs deliver security responsiveness by uniting core security functions and providing a central information and coordination point for security incident management and escalation, based on defined severity levels. During live incidents, the Barclays Crisis Management Team monitors the response by Incident Management Teams, Resilience Leads, and others, and has discretion to invoke one or more Barclays Crisis Leadership Teams (CLTs). CLTs are business-led teams at entity, business unit, and regional levels that provide strategic leadership in a crisis, maintain incident management oversight, and coordinate key decision making. To manage security risk from Barclays’ third-party suppliers,