FIRST BANCORP /PR/

Cybersecurity Risk Management and Strategy

The Corporation recognizes

the significance of cybersecurity

industry and the potential

risks associated, such

as the

risks arising from

the loss of confidentiality,

or availability of

information systems.

processes to identify,

assess,

and

monitor

risks

from

threats

are

part

of

its

Risk

(“ERM”)

Program,

under

which

the

has

a

Program

(“CISP”).

risk

is

managed as

part of

information technology

risk, under

the direction

of the

Corporate Security

Office (“CSO”)

led by

the

Chief Information Security Officer (“CISO”) who ultimately

reports to the Chief Operating Officer (“COO”).

The

CISP

outlines

the

overall

vision,

direction,

and

to

protect

the

confidentiality,

and

of

and

seeks

to

prevent

unauthorized

access

as

by

and

security best practices. The CISP

is based on well-renowned frameworks

such as the International Organizational

Standard ISO 27000

series and

the NIST

Cybersecurity Framework.

As such,

it serves as

a guide

for the

implementation of

security safeguards

across the

and

its

The

CISP

also

addresses

and

for

efforts,

any

notification,

on the

of the

specific security

incident. In

the

CISP incorporates

a

risk-based approach

to ensure that

risk is

treated in

a consistent

and effective

matter and

is designed

to protect

classified information

to

prevent

to

unauthorized

individuals;

prioritize

the

use

of

by

concentrating

on

applications;

develop

cost-effective,

and

reliable

systems;

ensure

the

proper

and

secure

disposal

of

sensitive

information; and implement adequate processes to ensure compliance.

The

ERM

Program

a

Incident

Response

Program,

which

a

risk-based

escalation

process

to

manage

and

notify

the

Risk

of

the

Board

of

and

stakeholders

as

appropriate.

The

the

Technology

(“IT”)

Risk

Unit

of

the

ERM

Department,

which is comprised of several members such as IT

Risk Managers and the ERM Director who is part

of senior management, as well as

external expertise, in the review of

its processes, including an independent

internal assessment of cybersecurity measures

and controls.

The

also

invests

in

threat

intelligence,

vulnerability

and

incident

drills.

all

of

the

and

consultants

with

access

to

the

network

are

to

a

awareness

program

on

an

annual

basis.

awareness

and

training

on

and

cybersecurity risk is provided to the Board on a regular basis.

The

has

a

Vendor

Program

and

a

Third-Party

Risk

to

manage

the

risks

with

conducting

with

which

the

requirement

for

vendors

to

to

ascertain

and

confidentiality

of

the

resources.

The

places

vendors into tiers

inherent risk due

to the nature

of the relationship

with that vendor

to determine any

additional security

requirements commensurate to such level of risk.

The Corporation does not believe

that risks from cybersecurity threats or

attacks, including as a result of any

previous cybersecurity

incidents, have

affected the Corporation’s

business strategy,

results of operations or

financial condition as

While

the

to

closely

monitor

cyber

risk

and

has

that

are

to

assess,

identify,

and manage

material risks

from cybersecurity

threats, security

controls, no

matter how

well designed

or implemented,

may

only partially

mitigate and

not fully eliminate

these risks.

Events, when

detected by

security tools

or third parties,

may not

always be

understood

or

acted

upon.

See

Item

1A,

“Risk

Factors

–

Risks

Relating

to

and

Technology”

for

more

information on how cybersecurity risk could adversely affect the

Corporation, which should be read in conjunction with this Item 1C.

Responsibility for

risk oversight

and management

generally lies

Directors.

To

effectively manage

of

the

CISP’s

and

risk

the

Board

has

delegated

such

to

the

Risk

As part

of

its oversight,

the

reports

from

the

Risk Management

and

IT

Steering

which

are

at

the

level,

on

the

The

Internal Audit Department

performs periodic audits of

information security practices and

presents them to the

Audit

of

the

Board.

The scope

of

testing

is in

with

and

prudent

The

periodicity

of

testing

is determined

by

the

Audit

based

on

their

risk

assessment.

Findings

from

audit

are

to

and

the

Audit

In

the

Vendor

reports

to the

Vendor

program status.

The Risk

with

updated

on

the

matters

in

the

Risk

meetings

as

it

relates

to

the

CISP

and

the

overall

information security

strategic direction

and evaluates

and approves

(if necessary)

reports presented

by executive

management related

to the information security strategic direction of the Corporation.

The

CSO

the

CISP,

its

development,

and

any

updates

in

to

changes

in

and

other

and reports

on a

quarterly basis

to the

IT Steering

and to

the Board’s

Risk Committee.

The Security

and

Facilities

who

has

been

in

charge

since

2016,

has

over

years

of

in

functional

expertise

concerning all aspects of information

security, integrity

and privacy of systems, and data

resources, and holds several relevant

licenses

and/or

certifications.

Also,

certain

topics

related

to

are

presented

on

an

ad

hoc

basis

to

the

Risk

The

CSO

the

Risk

regular

reports

and

engages

in

discussions

on

the

of

the

CISP,

risk

mitigation

and

progress.

The

Risk

reviews

and

approves

the

CISP annually and receives a report on the security safeguards annually.

See “Risk Management – Risk Governance” for more information on the Corporation’s

risk governance structure.