FIRST BANCORP PR

Cybersecurity Risk Management and Strategy

The Corporation recognizes

the significance of cybersecurity

in the financial

industry and the potential

risks associated, such

as the

risks arising from

the loss of confidentiality,

or availability of

information systems. The

processes to identify,

assess, and

monitor material

cybersecurity threats

are part

of its Enterprise

(“ERM”) Program,

documented as

part of the

Corporate Incident

Response Program

and under which

implemented a

Corporate Information

Security Program

(“CISP”). Cybersecurity

risk is

managed as

part of

risk,

under

the

of

the

Office

(“CSO”)

led

by

the

Officer

(“CSO

Officer”),

who

reports to the Chief Operations Officer.

The CSO Officer also serves as Chief Information Security Officer

(“CISO”).

The

CISP

outlines

the

overall

vision,

direction,

and

to

protect

the

and

of

and

seeks

to

prevent

access

as

by

and

security best practices. The CISP

is based on well-renowned frameworks

such as the International Organizational

Standard ISO 27000

series and

the NIST

Cybersecurity Framework.

it serves as

a guide

for the

security safeguards

across the

and

its

The

CISP

also

breaches

and

for

any

notification,

on the

of the

specific security

incident. In

the

CISP incorporates

a

risk-based approach

to ensure that

risk is

treated in

a consistent

and effective

matter and

is designed

to protect

classified information

to

prevent

to

individuals;

prioritize

the

use

of

by

concentrating

on

applications;

develop

cost-effective,

and

reliable

systems;

ensure

the

proper

and

secure

disposal

of

information; and implement adequate processes to ensure compliance.

The ERM

Program

risk-based

escalation process

to manage

corporate incidents,

cybersecurity incidents,

and

notify

the

Risk

of

the

Board

of

and

as

appropriate.

The

the

ERM Department,

comprised of

several members

such as

the ERM

who is

part of

senior management,

as well

as

expertise,

in

the

review

of

its

processes,

an

of

and

controls. The

Corporation also

invests in

threat intelligence,

vulnerability management,

and incident

response drills.

all

of the

consultants with

network are

complete a

awareness

program

on

an

annual

basis.

awareness

and

on

and

cybersecurity risk is provided to the Board on a regular basis.

The

has

a

Vendor

Program

and

a

Third-Party

Risk

to

manage

the

risks

with

conducting

with

vendors,

which

the

requirement

for

vendors

to

to

ascertain

and

confidentiality

of

the

The

places

vendors into tiers

inherent risk due

to the nature

of the relationship

with that vendor

to determine any

additional security

requirements commensurate to such level of risk.

The Corporation does not believe

that risks from cybersecurity threats or

attacks, including as a result of any

previous cybersecurity

incidents, have materially

affected the Corporation

’s business

results of operations or

financial condition as

While

the

to

closely

monitor

cyber

risk

and

has

that

are

to

assess,

identify,

and manage

material risks

from cybersecurity

threats, security

controls, no

matter how

well designed

or implemented,

may

only partially

mitigate and

not fully eliminate

these risks.

Events, when

detected by

security tools

or third parties,

may not

always be

immediately

understood

or

acted

upon.

See

Item

1A,

“Risk

Factors

–

Risks

Relating

to

and

Technology”

for

more

information on how cybersecurity risk could adversely affect the

Corporation, which should be read in conjunction with this Item 1C.

Responsibility for

risk oversight

and management

generally lies

Directors. To

effectively manage

of

the

CISP’s

and

risk

the

Board

has

delegated

such

to

the

Risk

Committee.

As

part

of

its

the

Risk

reports

from

the

Risk

and

Technology

(“IT”)

Steering

Committee,

which

are

at

the

level,

on

the

cybersecurity processes.

Internal Audit

Department performs

periodic audits of

information security

and

them

to

the

Audit

of

the

Board.

The

scope

of

testing is

in

with

guidance and prudent business practices. The periodicity of

testing is determined by the Corporate Internal Audit Department

their risk

assessment. Findings

from internal

audit procedures

are reported

to Management

and the

of the

Directors. In addition, the

Vendor

Management Committee periodically

reports to the Risk

Committee about the Vendor

program

status.

The

the

Board with

updated

on the

matters

in

the Risk

meetings

as it

relates

to

the

CISP and

the

overall

and

and

(if

necessary)

reports presented by executive management related to the information

security strategic direction of the Corporation.

The

CSO,

led

by

the

CSO

the

CISP,

its

development,

and

any

updates

in

to

changes

in

operations and other circumstances,

and reports on a quarterly

basis to the IT Steering

Committee and to the

Board’s Risk Committee.

The CSO Officer,

who has been in charge since

2016, has over 20 years of experience

in functional expertise concerning all

aspects of

and

privacy

of

and

data

resources,

and

holds

several

licenses

and/or

certifications.

Also, certain

topics related

to information

security are

presented on

an ad

hoc basis

to the

Committee.

The CSO provides

the Board’s

Risk Committee regular

reports and engages in

discussions on the effectiveness

of the CISP,

risk mitigation

strategy and

progress. The

reviews and

approves the

CISP annually

and receives

a report

on

the security safeguards annually.

See “Risk Management – Risk Governance” for more information on the Corporation’s

risk governance structure.