Company: ADZCF
Filing Date: 2025-03-13
Form Type: 20-F
Source: 0001159508-25-000020
Chunk: 320

Company: DEUTSCHE BANK AKTIENGESELLSCHAFT
Filing Date: 2025-03-13
Form: 20-F
Chunk 320
---
 successful attack, there might be impact on Deutsche Bank’s stakeholders and the wider financial ecosystem due to compromised data, unintentional spread of malware, unavailability of services, and the inaccessibility of systems and/or data. This encompasses internal and third-parties information technology systems. A successful cyberattack could have a significant negative direct or indirect impact on the bank that may result in the disclosure or misuse of client, as well as proprietary information, damage to or inability to access information technology systems, statutory or regulatory non-compliance and financial losses. Potential consequences range from reputational damage and client dissatisfaction via contractual non-compliance (e.g., if services are not provided as agreed) to remediation costs (such as for investigation and reestablishing services), increased cybersecurity costs (such as for additional personnel, technology, or third-party vendors), and potential penalties and fines, to personal data breach notification obligations, and litigation exposure. Deutsche Bank maintains insurance as an additional risk mitigant for cyber risk. The bank´s insurance coverage is designed to include mitigation of the financial impact of security incidents, it may however not fully cover all potential losses, including reputational damage or indirect costs associated with a cyber event.Notwithstanding the bank’s security measures, there can be no assurance that its policies, controls, or cyber insurance coverage will be sufficient to prevent or fully mitigate the impact of future cyber incidents and it could have a material adverse effect on its financial condition. Policies and risk management The bank’s policies and controls support risk reduction and mitigation for potential negative impacts. Information Security Risk is managedas an Operational Risk under the Non-Financial Risk Management Framework of the bank. The Chief Security Office is responsible for and executes security matters against the Non-Financial Risk Management Framework and leverages the results of its various instruments whereas Non-Financial Risk Management provides oversight, review, and challenge. Measures for the further reduction of material residual risks may include policy changes or policy amendments at divisional or group level as well as prioritized investment and accelerated implementation of risk mitigating activities. Security risks are assessed on a continual basis, through analysis of internal and external events, events at peer institutions, monitoring of the threat environment, and discussion in various forums. The annual risk and control assessment process evaluates risk scenarios such as service disruption, system misuse, data distortion, asset or data destruction, data disclosure, financial theft and non-adherence or non-conduct to regulatory policies and laws. It leverages industry standard threat assessment frameworks, such as MITRE, and provides the foundation for the assessment of