Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 356

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 356
---
 and compliance; cyber threat intelligence; and identity access management. The Group CISO has more than 20 years of experience managing cybersecurity for global financial institutions, including responsibility for cybersecurity fusion centres, cyber intelligence, security engineering and architecture, security operations, and network services. The Group CISO is supported by a team of CISOs for individual business units and jurisdictions. Chief Information Security Office leaders manage Barclays’ cybersecurity activities and are accountable for the day-to-day monitoring of residual risk, identification of gaps, oversight of remedial actions and implementation of strategy. The Group CISO and supporting leadership team collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including those that represent critical national infrastructure, such as telecommunications and financial institutions. They are supported by teams of subject matter experts and analysts in a variety of specialisations, such as penetration testing, cyber-forensic investigations, security engineering, and vulnerability management. Supporting the delivery of Barclays’ cyber and information security strategy are multiple management committees, forums, and councils, including Cyber Control Councils for each of the 11 Standards supporting the Group Information and Cybersecurity Policy. These Cyber Control Standards Councils feed into the Cybersecurity Horizontal Controls Forum, the Group Controls Committee, the Group Risk Committee, and ultimately the Board Risk Committee. In addition, the Group COO holds standalone business reviews that include management updates on the status of cybersecurity across the Group, and a standalone COO Controls Forum that also escalates to the Group Controls Committee. Barclays’ Operational Risk and Internal Audit functions provide independent views of cyber risk management from second and third line of defence perspectives. Barclays assesses its cybersecurity activities against the industry-recognised National Institute of Standards and Technology (NIST) Cybersecurity Framework. Under Barclays' Enterprise Risk Management Framework, there is an Information and Cyber Security Policy supported by 11 Standards which define the minimum requirements for cybersecurity matters across the Barclays Group.

| Strategy                   | Shareholderinformation | Climate and sustainabilityreport |     | Risk review | Financial review | Financialstatements |     | Barclays PLC 2024Annual Report onForm 20-F | 189 |
|                            | Governance             |                                  |     |             |                  |                     |     |                                            |     |
| ESG Governance (continued) |                        |                                  |     |             |                  |                     |     |                                            |     |

The Policy leverages key risk indicators defined in the Standards to integrate cybersecurity risk management into the Group’s Enterprise Risk Management Framework. The Standards cover the following topics: Cryptography, Network Security