Company: BBD
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001292814-25-001244
Chunk: 329

Company: BANK BRADESCO
Filing Date: 2025-03-31
Form: 20-F
Item: Item 16
Chunk 329
---
-Token) version. We have continuously developed awareness campaigns through
client channels and social media. On our “seguranca. bradesco” website (information published on the website is not incorporated
by reference in this annual report) there are several guidelines for the public, including videos of the web series “ Protect Yourself”
with prevention tips on current key scams/fraud, which aim to improve user knowledge of our security measures.

Additionally, we have our
Information Security Acculturation Program, for employees, this serve as the fundamental foundation for aligning the pillars of technology,
processes, and people, ensuring the effectiveness of security measures. As such, we invest in training and awareness materials for employees,
associates and clients ensuring they not only understand the issue but are prepared for and informed about the associated risks and threats.

CMN amended its Resolution
No. 4,893/21, that contains requirements related to the cybersecurity policy and the requirements for hiring data processing and storage
services and cloud computing to be observed by institutions authorized to operate by the Central Bank of Brazil and in April 2021, following
the same guidelines, Central Bank of Brazil amended BCB Resolution No. 368/24 to amend the requirements for payment institutions. In short,
Resolutions No. 4,893/21 and No. 368/24 enhance the previously existing provisions regarding the cybersecurity policy, without changing
the primary guidelines of such resolutions. Some of the most relevant changes include the need for financial and payment institutions,
as well as securities brokerage firms, securities distribution companies and foreign exchange brokerage companies authorized to operate
by the Central Bank of Brazil, to have documented criteria for cases that result in a crisis situation due to a cyberattack and interruption
of relevant services. In addition, we observe the provisions of the Open Finance Security Manual, which establishes the minimum-security
requirements of APIs (Application Programming Interface) and other systems related to Open Finance, of which we are mandatory participants
according to Communication No. 36,480/20, instituted by BCB Normative Instruction No. 305/22.

16. K.20 Cybersecurity risk

Cybersecurity risk is represented
by the possibility of cyber incidents, including attacks, intrusions and leakages, that could compromise the confidentiality, integrity
and/or availability of our critical processes, assets and/or infrastructure.

16. K.30 Cybersecurity management
process

We carry out corporate risk
control in anintegratedand independent manner, maintaining and encouraging a collective decision-making