Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 153

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 153
---
, along with accelerating the potential this technology brings. We work with third parties, including suppliers, financial infrastructure bodies and other non- traditional third parties, in an effort to help reduce the threat of cyber-attacks impacting our business services. We have a third-party security risk management process in place to assess, identify and manage the risks associated with cybersecurity threats with supplier and other third-party relationships. The process includes risk-based cybersecurity due diligence reviews that assess third parties’ cybersecurity programmes against our standards and requirements. Policy and governance We have a robust suite of cybersecurity policies, procedures, and key controls to help with the effective oversight and management of the organisation. This includes but is not limited to defined information security responsibilities for employees, contractors and third parties, as well as standard procedures for cyber incident identification, investigation, mitigation and reporting. We operate a three lines of defence model, aligned to the enterprise risk management framework, to help oversight and challenge of our cybersecurity capabilities and priorities. Within the first line of defence, risk owners within global business and functions are accountable for identifying and managing cyber risk. They work with cybersecurity control owners to apply risk treatment in line with our risk appetite. Our controls are designed to be executed in line with our policies and are reviewed and challenged by our risk stewards representing the second line of defence. They are independently assured by the Global Internal Audit function, the third line of defence. The assessment and management of our cybersecurity risk is led and coordinated by a Global Chief Information Security Officer (‘CISO’). Our Global CISO has extensive experience in financial services, security and resilience as well as strategy, governance, risk management and regulatory compliance. The Global CISO is supported by regional and business-level CISOs. In the event of incidents, the Global CISO and relevant supporting CISOs are informed and are engaged in alignment with our cybersecurity incident response protocols. Key performance indicators, control effectiveness and other matters related to cybersecurity, including significant cyber incidents, are presented on a regular basis to various management risk and control committees including to Board committees, the Group Risk Management Meeting and across global businesses, functions and regions. This is done to help ensure ongoing awareness and management of our cybersecurity position. Our cybersecurity capabilities are periodically assessed against standards issued by the National Institute of Standards and Technology and by independent third parties, and we proactively collaborate with regulators to participate in regular testing activities. In addition, HSBC engages external independent third parties to support our penetration and threat-led penetration testing. Cyber training and awareness We understand the important role our people play in protecting