FIRST BANCORP PR

Cybersecurity Risk Management and Strategy

The Corporation recognizes

the significance of cybersecurity

in the financial

industry and the potential

risks associated, such

as the

risks arising from

the loss of confidentiality,

or availability of

information systems.

processes to identify,

assess,

and

monitor

risks

from

threats

are

part

of

its

Risk

(“ERM”)

Program,

under

which

the

has

a

Program

(“CISP”).

risk

is

managed as

part of

risk, under

the direction

of the

Corporate Security

Office (“CSO”)

led by

the

Officer

(“CSO Officer”),

who

reports

to

the

Chief

The

CSO

Officer

also

serves

as

Chief Information Security Officer (“CISO”).

The

CISP

the

overall

vision,

direction,

and

to

protect

the

and

availability

of

and

seeks

to

prevent

access

as

by

and

security best practices. The CISP

is based on well-renowned frameworks

such as the International Organizational

Standard ISO 27000

series and

the NIST

Cybersecurity Framework.

it serves as

a guide

for the

implementation of

security safeguards

across the

and

its

The

CISP

also

and

for

efforts,

any

notification,

on the

of the

specific security

incident. In

the

CISP incorporates

a

risk-based approach

to ensure that

risk is

treated in

a consistent

and effective

matter and

is designed

to protect

classified information

to

prevent

to

individuals;

prioritize

the

use

of

by

concentrating

on

applications;

develop

cost-effective,

and

reliable

systems;

ensure

the

proper

and

secure

disposal

of

information; and implement adequate processes to ensure compliance.

The

ERM

Program

a

Incident

Response

Program,

which

a

risk-based

escalation

process

to

manage

and

notify

the

Risk

of

the

Board

of

and

stakeholders

as

appropriate.

The

the

Technology

(“IT”)

Risk

Unit

of

the

ERM

Department,

which is comprised of several members such as IT

Risk Managers and the ERM Director who is part

of senior management, as well as

external expertise, in the review of

its processes, including an independent

internal assessment of cybersecurity measures

and controls.

The

also

invests

in

threat

intelligence,

vulnerability

and

incident

drills.

all

of

the

and

consultants

with

access

to

the

network

are

to

complete

a

awareness

program

on

an

annual

basis.

awareness

and

on

and

cybersecurity risk is provided to the Board on a regular basis.

The

has

a

Vendor

Program

and

a

Third-Party

Risk

to

manage

the

risks

with

conducting

with

vendors,

which

the

requirement

for

vendors

to

to

ascertain

and

confidentiality

of

the

resources.

The

places

vendors into tiers

based on the

inherent risk due

to the nature

of the relationship

with that vendor

to determine any

additional security

requirements commensurate to such level of risk.

The Corporation does not believe

that risks from cybersecurity threats or

attacks, including as a result of any

previous cybersecurity

incidents, have

affected the Corporation’s

business strategy,

results of operations or

financial condition as

While

the

to

closely

monitor

cyber

risk

and

has

that

are

to

assess,

identify,

and manage

material risks

from cybersecurity

threats, security

controls, no

matter how

well designed

or implemented,

may

only partially

mitigate and

not fully eliminate

these risks.

Events, when

detected by

security tools

or third parties,

may not

always be

understood

or

acted

upon.

See

Item

1A,

“Risk

Factors

–

Risks

Relating

to

and

Technology”

for

more

information on how cybersecurity risk could adversely affect the

Corporation, which should be read in conjunction with this Item 1C.

Responsibility for

risk oversight

and management

generally lies

.

To

effectively manage

of

the

CISP’s

and

risk

the

Board

has

delegated

such

to

the

Risk

As part

of

its oversight,

the

reports

from

the

and

IT

Steering

Committee,

which

are

at

the

level,

on

the

The

Internal Audit Department

performs periodic audits of

information security practices and

presents them to the

Audit

of

the

Board.

The scope

of

testing

is in

with

and

prudent

The

periodicity

of

testing

by

the

Audit

based

on

their

risk

assessment.

Findings

from

audit

are

to

and

the

Audit

In

the

Vendor

reports

to the

Vendor

program status.

The Risk

with

updated

on

the

matters

in

the

Risk

meetings

as

it

relates

to

the

CISP

and

the

overall

information security

strategic direction

and evaluates

and approves

(if necessary)

reports presented

by executive

management related

to the information security strategic direction of the Corporation.

The

CSO,

led

by

the

CSO

the

CISP,

its

development,

and

any

updates

in

to

changes

in

operations and other circumstances,

and reports on a quarterly

basis to the IT Steering

Committee and to the

Board’s Risk Committee.

The CSO Officer,

who has been in charge since

2016, has over 20 years of experience

in functional expertise concerning all

aspects of

and

privacy

of

and

data

and

holds

several

licenses

and/or

certifications.

Also, certain

topics related

to information

security are

presented on

an ad

hoc basis

to the

The CSO provides

the Board’s

Risk Committee regular

reports and engages in

discussions on the effectiveness

of the CISP,

risk mitigation

strategy and

progress. The

reviews and

approves the

CISP annually

and receives

a report

on

the security safeguards annually.

See “Risk Management – Risk Governance” for more information on the Corporation’s

risk governance structure.