Société Générale / Risk report 2021 - Pillar 3 2020

10 OPERATIONAL RISK ORGANISATION OF OPERATIONAL RISK MANAGEMENT | SOCIETE GENERALE GROUP | PILLAR 3 - 2021 189 According to the internal control system, the level 2 permanent control Risk teams carry out this mission on the operational risks covering the risks specific to the various businesses (including operational risks related to credit risks and market risks), as well as the risks associated with purchases, communication, real estate, human resources and information system. Risk related to security of property and people The Group Security Division (SEGL/DSG) is in charge of establishing a forward-looking overview of security, allowing to assess threats and identify weak signals, forewarning and protecting persons, Group’s physical and intangible assets. Also coordinate the planning of actions to maintain the Bank’s critical activities under all circumstances and assist crisis management if necessary. SEGL/DSG acts as first line of defence (LoD1 expertise) on issues of security. To this end, the Division’s main roles are as follows: defining a Group-level overview of security issues; p identifying existing and future security threats and risks for the p Group as well as its weaknesses to confront them; developing and disseminating Group mechanisms and policies to p better protect its activities and ensure it is capable of withstanding security crises; implementing the Group’s security oversight mechanism; p organising the Group’s crisis management system; p coordinating relations with national, European and international p security agencies in respect of security issues; developing and coordinating economic intelligence; p assisting in combating fraud; p strengthening the security culture within the Group (training, p communication campaigns, etc.). The management of all these risks is based on operational risk systems and the second line of defence is provided by the Risk Department. Risks related to information security and information and communication technologies Given the importance for the Group of its information system and the data it conveys and the continuous increase in the cybercriminal threat, the risks related to information and communication technologies and to security (ICT) are major for Societe Generale. Their supervision, integrated into the general operational risk management system, is steered as the first line of defence by a dedicated area of ​​ expertise (Information and Information Systems Security – ISS) and the second line of defence is provided by the Risk Department. They are subject to specific monitoring by the management bodies through sessions dedicated to Group governance (Risk Committee, CORISQ, CCCIG, DTCO) and a quarterly dashboard which presents the risk situation and action plans on the eight main themes of information and communication technologies risks. The Department Security of the Group, housed within the General Secretariat, is responsible for protecting information. It ensures in particular: the publication of a new Information Security Group policy that p encompasses both human and technical aspects; the redesign of the “Electronic Communications Charter” into the p “Charter for the Protection of Information and IT Resources”; the co-construction with RESG of the Data-Protection program, p which aims to equip employees with a tool for classifying and protecting office documents; the distribution of a new e-learning on information security to all of p the Group’s employees in France and internationally. The person in charge of risks related to information and communication technologies (ICT) and security of information systems is housed at the Corporate Resources and Digital Transformation Division. Under the functional authority of the Director of Group Security, he recommends the strategy to protect digital information and heads up the IT security department. The IT security framework is aligned with the market standards (NIST, ISO 27002), and implemented in each BU/SU. Risk management associated with cybercrime is carried out through the tri-annual Information Systems Security (ISS) master plan. In order to take into account the evolution of the threat, in particular that related to ransomware, and in line with the Group strategy, the ISS 2021-2023 master plan is structured, with a budget of EUR 650 million over the period 2021-2023, around two pillars that guide actions by 2023: protect the data of our customers and our ability to operate the p banking services, by integrating the threats, the requirements of the regulators, and the need to support the Business Units and Service Units in their digital transformation and the evolution of uses that accompanies it. A risk-based approach allows us to concentrate our efforts on the most critical elements and data, in connection with the work of the Security Department cited above. We are preparing to manage a major cyber crisis by improving in particular our detection capacity, our ability to control our IT links with our partners and subsidiaries, and our ability to rebuild the information system; increase our operational efficiency by gaining overall consistency, p and by increasing our protections and our ability to react. In particular by developing the management of the cyber security department, by optimizing our processes and our tools to be able to deploy new protections at constant cost. Finally, by working on the management of human resources in the filiere, in particular on the development of skills and networks of expertise. At the operational level, the Group relies on a CERT (Computer Emergency Response Team) unit in charge of incident management, security watch and the fight against cybercrime. This team uses multiple sources of information and monitoring, both internal and external. Since 2018, this unit has also been strengthened by the establishment of an internal Red Team whose main tasks are to assess the effectiveness of the security systems deployed and to test the detection and reaction capabilities of the defence teams (Blue Teams) during an exercise simulating a real attack. The services of the Red Team enable the Group to gain a better understanding of the weaknesses in the security of the Societe Generale information system, to help in the implementation of global improvement strategies, and also to train cybersecurity defence teams. CERT works closely with the Security Operation Center (SOC), which is in charge of detecting security events and processing them.