Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 574

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 574
---
 of Excellence for cyber risk, providing an opportunity to strengthen control risk activities while achieving efficiencies, simplification and harmonization; • an update of internal regulation to align with new regulatory requirements (e.g. DORA Regulation); • a review of our oversight procedures (risk indicators, risk appetite and reference risk); • participation in the ECB’s first Cyber Resilience Stress Test; • the automation of dashboards to embed several sources of information and provide a consolidated view of cyber risk.

| For more details on cyber security, see section5'Research, development and innovation (R&D&I)'on 'Economic and financial review' chapter. |

IT risk Our aim to become the best open financial services platform on the back of digital transformation requires constant review, assessment and enhancement of our controls to mitigate and manage technological risk. Despite a demanding environment under constant change, we are quickly adapting our business model and our technology to support the global businesses in their digital transformation by providing them with global platforms that draw on innovative capabilities to meet the new needs of our customers and new regulatory requirements. This also aims to strengthen our position as a digital bank with a global footprint that can adapt to the changing demands of the market.

For 2024, the key aspects of our IT Risk Management programme were: • monitoring the implementation of actions to meet the requirements of DORA regulation, including a deep dive into the operational resilience scenario mitigation strategy in relation to data mismanagement; • making key IT assets less obsolete to fit with our risk appetite; • strengthening the Public Cloud control model by embedding essential controls within the risk and control self-assessment for the first time; • continuing to enhance automation to correlate data, analyse and report on technology risks to facilitate the collection and consolidation of information, prioritize risk management, and enable more effective independent oversight; • making headway with the implementation of automated solutions to analyse back-up and inventory controls that help enhance the monitoring and control of technological risk. Supplier risk management Our digitalization strategy sets out to offer our customers the best solutions and products in the market. This may lead to an increase in third-party services, cloud services and the large-scale use of new technologies. In 2024, we boosted our supplier management model and internal control framework due to increased cyber risk, environmental (ESG) risks and regulatory requirements (especially DORA). We implemented a new IT platform to assess and manage the risks in outsourcing and third-party agreements. We continued to bolster our methodologies and contractual frameworks to enhance the monitoring of third-party risk in our subsidiaries. Moreover