Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 226

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 16K
Chunk 226
---
 not only relevant for the financial industry, but are increasingly hitting its supply chains. We are monitoring these Cybersecurity risks from our suppliers, via the Third-Party Cyber Risk Management process. This process is part of the generic risk management framework as defined in the Non-Financial Risk Framework Policies. These policies are detailed out in a set of Minimum Standards, amongst which the Security Monitoring Minimum Standard.
ING Group Annual Report 2024 on Form 20-F 

Contents       Part I         Part II        Part III       Additional information        Financial statements    
The policy documents (policies, minimum standards, process control standards) identify inherent risks and contain objectives and controls to mitigate identified inherent risks as well as a section on roles and responsibilities regarding IT and controls. 
The different processes for assessing, identifying, and managing material risks from cybersecurity threats address the objectives as defined in the Information and Technology Risk Policy.
The Global CISO and key security positions are held by internal staff. ING Group IT Audit function is fully internally staffed. The key controls in the risk management framework relevant for internal control over financial reporting are being audited by an external auditor.
In addition, ING continues to strengthen its global cybercrime resilience through collaboration. with financial industry peers, law enforcement authorities, government (e.g. National Cyber Security Centre) and Internet Service Providers (ISPs).
Cybersecurity incidents
In 2024, we identified no cyber incidents on ING infrastructure that required public disclosure as soon as possible. However early this year we reported to the authorities that our login web channel in Spain suffered an unsuccessful attack, which was controlled by our cyber defense capabilities. We reported another incident to authorities when an IT change resulted in limited non-personal data disclosure for a dozen clients. 
We are currently not aware of any threats in our own environment that are likely to materialise in the near future.
Cybersecurity Governance
ING's risk and control structure is based on the three lines of defence (“3 LoD”) model. The 3 LoD model aims to provide a sound governance framework for financial and non-financial risk management by defining and implementing three risk management ‘layers’, with distinct roles, execution and oversight responsibilities. In 1st LoD, the IT Risk department within the CISO domain acts as a 1st line entity to support ING's local IT domains in managing, identifying, and dealing with IT and Cybersecurity Risk. Within each entity of ING, local IT Risk and IT Security functions exist. The Corporate IT Risk Management department is