Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	As detailed below, Barclays' Chief Information Security Office operates controls aimed at mitigating cybersecurity-related risks and understanding internal and external threats. Barclays deploys controls designed to protect its sensitive information and the data that has been entrusted to us by customers and clients, in line with our Standards, taking into account findings from internal and external reviews of our controls. Barclays seeks to protect the security of data we share with third parties, including by conducting remote and on-site inspections of certain suppliers to review their controls against contractual obligations and industry standards. A Third Party Service Provider Framework is in place which sets out control requirements for business units to manage the operational, reputational, conduct and legal risks to Barclays through its supply chain. The nature of such controls is described in further detail below. In operating under a hybrid working model, we have continued to educate colleagues on cybersecurity risks in order to help minimise risks related to remote working, such as data exploitation or leakage. Barclays works with industry bodies and cybersecurity vendors to learn and evolve from risk events in other organisations. Our teams use such intelligence to simulate plausible cybersecurity and data compromise scenarios that allow us to exercise, review and improve our response and recovery plans in preparation for evolving threats. Operational resilience The stability and resilience of our systems, workforce and premises, and the continued provision of third-party services, all have a direct impact on the quality of our service. Resilience and security are key priorities for the Board. Barclays continues to strengthen its resilience posture and is focused on its ability to recover from a range of ‘severe but plausible’ scenarios which could cause detriment to its customers and clients and the broader financial market. To enable this, we define Group-wide business services and their interdependencies across the Group, including technology, third-party services and our people and premises. Recovery plans and business response plans have been developed for a range of different disruption events, such as cyber or data integrity disruptions, technology failures, or the unavailability of our colleagues. These recovery plans are reviewed and validated through regular testing which supports our aim to reduce the volume and impact of operational incidents year-on-year. We also conduct regular assurance on third parties to assess their capability. Operational resilience is delivered through an established and robust Operational Resilience Framework which is underpinned by a Policy, Standards, methodologies and procedures, and is aligned to the requirements and expectations defined by our regulators. Our Operational Resilience Framework is integrated with Barclays’ Enterprise Risk Management Framework (ERMF) and sets the tone from the top. The Standards are embedded within the Barclays Controls Framework and provide a consistent approach across the Group. The Operational Recovery Planning Policy and Standards drive the identification of the business services that are most important to Barclays, its customers, clients and the markets in which Barclays operates. The Standards also define requirements for setting recovery targets, mapping of dependencies, planning and testing. Resilience and security are the responsibility of everyone within the Group. All permanent employees are required to complete annual mandatory training on these topics. Engaging external security consultants to conduct penetration tests, attack simulations and other reviews to independently benchmark Barclays’ cybersecurity capabilities is an important part of our cybersecurity programme that allows us to identify and remediate cybersecurity weaknesses. In 2025, individual testing activities were undertaken as part of the Chief Information Security Office’s threat led assurance model to assess Barclays’ cyber defence capabilities. Barclays also engages and partners with third-party security providers on certain activities such as cyber recovery, software vulnerability scanning, penetration testing, distributed denial of service (DDoS) attack prevention, phishing simulations, third-party risk management, incident response, threat intelligence, fraud prevention, and industry benchmarking. An important part of Barclays’ security and cybersecurity environment is its Joint Operations Centres (JOCs), which operate 24/7 from three globally strategic locations, linking Barclays’ security professionals and incident response managers with control functions and business unit representatives. The JOCs deliver security responsiveness by uniting core security functions and providing a central information and coordination point for security incident management and escalation, based on defined severity levels. During escalating, significant incidents, the Barclays Crisis Management Team monitors the response by Incident Management Teams, Resilience Leads, and others, and will invoke the relevant Barclays Crisis Leadership Teams (CLTs) if the severity of the incident so requires. CLTs are business-led teams at entity, business unit, and regional levels that provide strategic leadership in a crisis, maintain incident management oversight, and coordinate key decision making. To manage security risk from Barclays’ third-party suppliers, many of which perform critical services for Barclays' businesses and handle sensitive Barclays data, we have a set of contractual Information and Cyber Security Supplier Control Obligations that are based on requirements in our internal Standards. Using our dedicated Third Party Security Management team’s capabilities, as well as third-party tooling, we conduct assurance over our third parties and their respective suppliers and partners against those obligations. Activity is structured on a risk-based approach that prioritises suppliers that underpin our most important business services. Identified issues are managed formally, but we also engage proactively with third-party suppliers to help them strengthen their security and resilience posture. To recognise the risk presented by third-party suppliers, which are increasingly targeted by threat actors, we regularly alert third-party suppliers where we anticipate that they may be more vulnerable and should take preventative action. Notwithstanding such third-party risk management efforts, Barclays does not have direct control over the cybersecurity of the systems of its third parties and their respective suppliers and partners, limiting the Group’s ability to effectively protect and defend against certain threats. Certifications Barclays holds four ISO27001 certifications (i.e., the international standard on how to manage information security), the Cyber Essentials/Cyber Essentials Plus Certification, and a UK certification for Digital Banking. Training Barclays requires colleagues to complete mandatory information security training at least annually. Topics covered include incident reporting procedures, protecting sensitive data, device security, data leakage prevention, social engineering awareness, and password management. Consequences of non-completion may include disciplinary action and impact to compensation. Barclays performs a number of key activities related to identifying, investigating, responding to and containing phishing, including an operational process that provides education and awareness through phishing simulation exercises, and management interventions for employees who demonstrate susceptibility to phishing lures. To report suspected phishing to Barclays' JOCs for further investigation, colleagues have a reporting tool integrated into their email account and receive feedback on whether the reported email was suspect or genuine. Barclays uses metrics to continually refine its phishing education and training.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	As detailed below, Barclays' Chief Information Security Office operates controls aimed at mitigating cybersecurity-related risks and understanding internal and external threats. Barclays deploys controls designed to protect its sensitive information and the data that has been entrusted to us by customers and clients, in line with our Standards, taking into account findings from internal and external reviews of our controls.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	false
Cybersecurity Risk Board of Directors Oversight [Text Block]	Chief Information Security Office Barclays' Chief Information Security Office exists to keep the bank, its customers, clients, and colleagues safe and secure, and to support the resilience of our operations. It supports Barclays' ability to operate in a protected and secure environment, and actively promotes a culture of security as everyone's responsibility. The Group Chief Information Security Officer (CISO) heads Barclays' Chief Information Security Office. Barclays’ Group CISO reports directly to the Group Co-Chief Operating Officers (members of the Group Executive Committee). Barclays’ Group CISO is responsible for assessing and managing Barclays’ risks from cybersecurity threats, and overseeing key areas that include cybersecurity operations (including cyber threat intelligence), proactive defence (which includes penetration testing and vulnerability management), security architecture and engineering, cyber posture and assurance (which includes third- party security management), data security, and identity and access management. The Group CISO is also supported by a team of CISOs and BISOs (Business Information Security Officers) for business units, regions and jurisdictions. Chief Information Security Office leaders manage Barclays’ cybersecurity activities and are accountable for the day-to-day monitoring of residual risk, identification of gaps, oversight of remedial actions and implementation of strategy. The Group CISO has more than 25 years of experience managing cybersecurity for global financial institutions, leading large-scale initiatives across all cybersecurity domains, including cyber defence, application security, vulnerability assessment, data protection, third party risk, cyber resilience, and security engineering. The Group CISO and supporting leadership team collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including those that represent critical national infrastructure, such as health care, telecommunications and financial institutions. They are supported by teams of subject matter experts and analysts in a variety of specialisations. Supporting the delivery of Barclays’ cyber and information security strategy are multiple management committees, forums, and councils, including Cyber Control Councils for each of the 12 Standards supporting the Group Information and Cybersecurity Policy (as more fully described below). These Cyber Control Standards Councils feed into the Cybersecurity Risk Category Controls Forum, the Group Controls Committee, the Group Risk Committee, and ultimately the Board Risk Committee. In addition, the Group Co-Chief Operating Officers hold business reviews that include management updates on the status of cybersecurity across the Group, and a standalone Chief Operating Office Controls Forum that also escalates to the Group Controls Committee. Barclays’ Operational Risk and Internal Audit functions provide independent views of cyber risk management from second and third line of defence perspectives. Barclays assesses its cybersecurity activities against the industry-recognised National Institute of Standards and Technology (NIST) Cybersecurity Framework. Under Barclays' ERMF, there is an Information and Cyber Security Policy supported by 12 Standards which define the minimum requirements for cybersecurity matters across the Barclays Group. The Policy is embedded into the Group's ERMF with Standards to implement cybersecurity risk management. The Standards cover the following topics: Cryptography, Network Security, Security Configuration, Data Loss Prevention, Vulnerability Management, Data Security, Incident Response & Threat Intelligence, Threat Management, Governance, Identity & Access Management, Third Party Information and Cyber Security, and Application Security. The Group CISO approves and is accountable for the Information and Cyber Security Policy and associated Standards. As part of our programme, we periodically assess our performance against these Standards and identify areas for improvement and remediation. The Barclays Group Board Risk Committee, within its oversight of Operational Risk as a principal risk, is responsible for overseeing risks arising from cybersecurity threats. In 2025, the Group CISO provided updates to the Barclays Group Board Risk Committee about cybersecurity risks facing the Group. Such updates addressed topics that included the cybersecurity threat environment and ransomware attack preparedness, measurement of Barclays' risk and control posture, cybersecurity incident trends and Barclays' response, plans to improve Barclays' ability to recover from a material cyber attack scenario, Barclays’ vulnerability management, privileged access to Barclays' systems, and regulatory developments. In addition, the Group Co-Chief Operating Officers provided updates to the Board detailing the progress being made to strengthen cybersecurity capabilities and reduce risk across the organisation as the threat environment continues to evolve.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	The Barclays Group Board Risk Committee, within its oversight of Operational Risk as a principal risk, is responsible for overseeing risks arising from cybersecurity threats.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	In 2025, the Group CISO provided updates to the Barclays Group Board Risk Committee about cybersecurity risks facing the Group. Such updates addressed topics that included the cybersecurity threat environment and ransomware attack preparedness, measurement of Barclays' risk and control posture, cybersecurity incident trends and Barclays' response, plans to improve Barclays' ability to recover from a material cyber attack scenario, Barclays’ vulnerability management, privileged access to Barclays' systems, and regulatory developments. In addition, the Group Co-Chief Operating Officers provided updates to the Board detailing the progress being made to strengthen cybersecurity capabilities and reduce risk across the organisation as the threat environment continues to evolve.
Cybersecurity Risk Role of Management [Text Block]	Barclays' Chief Information Security Office exists to keep the bank, its customers, clients, and colleagues safe and secure, and to support the resilience of our operations. It supports Barclays' ability to operate in a protected and secure environment, and actively promotes a culture of security as everyone's responsibility. The Group Chief Information Security Officer (CISO) heads Barclays' Chief Information Security Office. Barclays’ Group CISO reports directly to the Group Co-Chief Operating Officers (members of the Group Executive Committee). Barclays’ Group CISO is responsible for assessing and managing Barclays’ risks from cybersecurity threats, and overseeing key areas that include cybersecurity operations (including cyber threat intelligence), proactive defence (which includes penetration testing and vulnerability management), security architecture and engineering, cyber posture and assurance (which includes third- party security management), data security, and identity and access management. The Group CISO is also supported by a team of CISOs and BISOs (Business Information Security Officers) for business units, regions and jurisdictions. Chief Information Security Office leaders manage Barclays’ cybersecurity activities and are accountable for the day-to-day monitoring of residual risk, identification of gaps, oversight of remedial actions and implementation of strategy. The Group CISO has more than 25 years of experience managing cybersecurity for global financial institutions, leading large-scale initiatives across all cybersecurity domains, including cyber defence, application security, vulnerability assessment, data protection, third party risk, cyber resilience, and security engineering. The Group CISO and supporting leadership team collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including those that represent critical national infrastructure, such as health care, telecommunications and financial institutions. They are supported by teams of subject matter experts and analysts in a variety of specialisations. Supporting the delivery of Barclays’ cyber and information security strategy are multiple management committees, forums, and councils, including Cyber Control Councils for each of the 12 Standards supporting the Group Information and Cybersecurity Policy (as more fully described below). These Cyber Control Standards Councils feed into the Cybersecurity Risk Category Controls Forum, the Group Controls Committee, the Group Risk Committee, and ultimately the Board Risk Committee. In addition, the Group Co-Chief Operating Officers hold business reviews that include management updates on the status of cybersecurity across the Group, and a standalone Chief Operating Office Controls Forum that also escalates to the Group Controls Committee. Barclays’ Operational Risk and Internal Audit functions provide independent views of cyber risk management from second and third line of defence perspectives.
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	The Group Chief Information Security Officer (CISO) heads Barclays' Chief Information Security Office. Barclays’ Group CISO reports directly to the Group Co-Chief Operating Officers (members of the Group Executive Committee). Barclays’ Group CISO is responsible for assessing and managing Barclays’ risks from cybersecurity threats, and overseeing key areas that include cybersecurity operations (including cyber threat intelligence), proactive defence (which includes penetration testing and vulnerability management), security architecture and engineering, cyber posture and assurance (which includes third- party security management), data security, and identity and access management. The Group CISO is also supported by a team of CISOs and BISOs (Business Information Security Officers) for business units, regions and jurisdictions. Chief Information Security Office leaders manage Barclays’ cybersecurity activities and are accountable for the day-to-day monitoring of residual risk, identification of gaps, oversight of remedial actions and implementation of strategy. The Group CISO has more than 25 years of experience managing cybersecurity for global financial institutions, leading large-scale initiatives across all cybersecurity domains, including cyber defence, application security, vulnerability assessment, data protection, third party risk, cyber resilience, and security engineering. The Group CISO and supporting leadership team collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including those that represent critical national infrastructure, such as health care, telecommunications and financial institutions. They are supported by teams of subject matter experts and analysts in a variety of specialisations.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	The Group CISO has more than 25 years of experience managing cybersecurity for global financial institutions, leading large-scale initiatives across all cybersecurity domains, including cyber defence, application security, vulnerability assessment, data protection, third party risk, cyber resilience, and security engineering. The Group CISO and supporting leadership team collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including those that represent critical national infrastructure, such as health care, telecommunications and financial institutions. They are supported by teams of subject matter experts and analysts in a variety of specialisations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	The Group Chief Information Security Officer (CISO) heads Barclays' Chief Information Security Office. Barclays’ Group CISO reports directly to the Group Co-Chief Operating Officers (members of the Group Executive Committee). Barclays’ Group CISO is responsible for assessing and managing Barclays’ risks from cybersecurity threats, and overseeing key areas that include cybersecurity operations (including cyber threat intelligence), proactive defence (which includes penetration testing and vulnerability management), security architecture and engineering, cyber posture and assurance (which includes third- party security management), data security, and identity and access management. The Group CISO is also supported by a team of CISOs and BISOs (Business Information Security Officers) for business units, regions and jurisdictions. Chief Information Security Office leaders manage Barclays’ cybersecurity activities and are accountable for the day-to-day monitoring of residual risk, identification of gaps, oversight of remedial actions and implementation of strategy. The Group CISO has more than 25 years of experience managing cybersecurity for global financial institutions, leading large-scale initiatives across all cybersecurity domains, including cyber defence, application security, vulnerability assessment, data protection, third party risk, cyber resilience, and security engineering. The Group CISO and supporting leadership team collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including those that represent critical national infrastructure, such as health care, telecommunications and financial institutions. They are supported by teams of subject matter experts and analysts in a variety of specialisations. Supporting the delivery of Barclays’ cyber and information security strategy are multiple management committees, forums, and councils, including Cyber Control Councils for each of the 12 Standards supporting the Group Information and Cybersecurity Policy (as more fully described below). These Cyber Control Standards Councils feed into the Cybersecurity Risk Category Controls Forum, the Group Controls Committee, the Group Risk Committee, and ultimately the Board Risk Committee. In addition, the Group Co-Chief Operating Officers hold business reviews that include management updates on the status of cybersecurity across the Group, and a standalone Chief Operating Office Controls Forum that also escalates to the Group Controls Committee. Barclays’ Operational Risk and Internal Audit functions provide independent views of cyber risk management from second and third line of defence perspectives. Barclays assesses its cybersecurity activities against the industry-recognised National Institute of Standards and Technology (NIST) Cybersecurity Framework. Under Barclays' ERMF, there is an Information and Cyber Security Policy supported by 12 Standards which define the minimum requirements for cybersecurity matters across the Barclays Group.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Dec. 31, 2025

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

As detailed below, Barclays' Chief Information Security Office operates controls aimed at mitigating cybersecurity-related

risks and understanding internal and external threats.

Barclays deploys controls designed to protect its sensitive information and the data that has been entrusted to us by

customers and clients, in line with our Standards, taking into account findings from internal and external reviews of our

controls.

Barclays seeks to protect the security of data we share with third parties, including by conducting remote and on-site

inspections of certain suppliers to review their controls against contractual obligations and industry standards. A Third Party

Service Provider Framework is in place which sets out control requirements for business units to manage the operational,

reputational, conduct and legal risks to Barclays through its supply chain. The nature of such controls is described in further

detail below.

In operating under a hybrid working model, we have continued to educate colleagues on cybersecurity risks in order to help

minimise risks related to remote working, such as data exploitation or leakage.

Barclays works with industry bodies and cybersecurity vendors to learn and evolve from risk events in other organisations.

Our teams use such intelligence to simulate plausible cybersecurity and data compromise scenarios that allow us to

exercise, review and improve our response and recovery plans in preparation for evolving threats.

Operational resilience

The stability and resilience of our systems, workforce and premises, and the continued provision of third-party services, all

have a direct impact on the quality of our service.

Resilience and security are key priorities for the Board. Barclays continues to strengthen its resilience posture and is focused

on its ability to recover from a range of ‘severe but plausible’ scenarios which could cause detriment to its customers and

clients and the broader financial market. To enable this, we define Group-wide business services and their interdependencies

across the Group, including technology, third-party services and our people and premises. Recovery plans and business

response plans have been developed for a range of different disruption events, such as cyber or data integrity disruptions,

technology failures, or the unavailability of our colleagues. These recovery plans are reviewed and validated through regular

testing which supports our aim to reduce the volume and impact of operational incidents year-on-year. We also conduct

regular assurance on third parties to assess their capability.

Operational resilience is delivered through an established and robust Operational Resilience Framework which is

underpinned by a Policy, Standards, methodologies and procedures, and is aligned to the requirements and expectations

defined by our regulators. Our Operational Resilience Framework is integrated with Barclays’ Enterprise Risk Management

Framework (ERMF) and sets the tone from the top. The Standards are embedded within the Barclays Controls Framework

and provide a consistent approach across the Group.

The Operational Recovery Planning Policy and Standards drive the identification of the business services that are most

important to Barclays, its customers, clients and the markets in which Barclays operates. The Standards also define

requirements for setting recovery targets, mapping of dependencies, planning and testing.

Resilience and security are the responsibility of everyone within the Group. All permanent employees are required to

complete annual mandatory training on these topics.

Engaging external security consultants to conduct penetration tests, attack simulations and other reviews to independently

benchmark Barclays’ cybersecurity capabilities is an important part of our cybersecurity programme that allows us to

identify and remediate cybersecurity weaknesses. In 2025, individual testing activities were undertaken as part of the Chief

Information Security Office’s threat led assurance model to assess Barclays’ cyber defence capabilities.

Barclays also engages and partners with third-party security providers on certain activities such as cyber recovery, software

vulnerability scanning, penetration testing, distributed denial of service (DDoS) attack prevention, phishing simulations,

third-party risk management, incident response, threat intelligence, fraud prevention, and industry benchmarking.

An important part of Barclays’ security and cybersecurity environment is its Joint Operations Centres (JOCs), which operate

24/7 from three globally strategic locations, linking Barclays’ security professionals and incident response managers with

control functions and business unit representatives. The JOCs deliver security responsiveness by uniting core security

functions and providing a central information and coordination point for security incident management and escalation,

based on defined severity levels. During escalating, significant incidents, the Barclays Crisis Management Team monitors the

response by Incident Management Teams, Resilience Leads, and others, and will invoke the relevant Barclays Crisis

Leadership Teams (CLTs) if the severity of the incident so requires. CLTs are business-led teams at entity, business unit, and

regional levels that provide strategic leadership in a crisis, maintain incident management oversight, and coordinate key

decision making.

To manage security risk from Barclays’ third-party suppliers, many of which perform critical services for Barclays' businesses

and handle sensitive Barclays data, we have a set of contractual Information and Cyber Security Supplier Control Obligations

that are based on requirements in our internal Standards. Using our dedicated Third Party Security Management team’s

capabilities, as well as third-party tooling, we conduct assurance over our third parties and their respective suppliers and

partners against those obligations. Activity is structured on a risk-based approach that prioritises suppliers that underpin our

most important business services. Identified issues are managed formally, but we also engage proactively with third-party

suppliers to help them strengthen their security and resilience posture. To recognise the risk presented by third-party

suppliers, which are increasingly targeted by threat actors, we regularly alert third-party suppliers where we anticipate that

they may be more vulnerable and should take preventative action.

Notwithstanding such third-party risk management efforts, Barclays does not have direct control over the cybersecurity of

the systems of its third parties and their respective suppliers and partners, limiting the Group’s ability to effectively protect

and defend against certain threats.

Certifications

Barclays holds four ISO27001 certifications (i.e., the international standard on how to manage information security), the

Cyber Essentials/Cyber Essentials Plus Certification, and a UK certification for Digital Banking.

Training

Barclays requires colleagues to complete mandatory information security training at least annually. Topics covered include

incident reporting procedures, protecting sensitive data, device security, data leakage prevention, social engineering

awareness, and password management. Consequences of non-completion may include disciplinary action and impact to

compensation.

Barclays performs a number of key activities related to identifying, investigating, responding to and containing phishing,

including an operational process that provides education and awareness through phishing simulation exercises, and

management interventions for employees who demonstrate susceptibility to phishing lures. To report suspected phishing to

Barclays' JOCs for further investigation, colleagues have a reporting tool integrated into their email account and receive

feedback on whether the reported email was suspect or genuine. Barclays uses metrics to continually refine its phishing

education and training.

Cybersecurity Risk Management Processes Integrated [Flag]

true

Cybersecurity Risk Management Processes Integrated [Text Block]

As detailed below, Barclays' Chief Information Security Office operates controls aimed at mitigating cybersecurity-related

risks and understanding internal and external threats.

Barclays deploys controls designed to protect its sensitive information and the data that has been entrusted to us by

customers and clients, in line with our Standards, taking into account findings from internal and external reviews of our

controls.

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]

false

Cybersecurity Risk Board of Directors Oversight [Text Block]

Chief Information Security Office

Barclays' Chief Information Security Office exists to keep the bank, its customers, clients, and colleagues safe and secure,

and to support the resilience of our operations. It supports Barclays' ability to operate in a protected and secure

environment, and actively promotes a culture of security as everyone's responsibility.

The Group Chief Information Security Officer (CISO) heads Barclays' Chief Information Security Office. Barclays’ Group CISO

reports directly to the Group Co-Chief Operating Officers (members of the Group Executive Committee). Barclays’ Group

CISO is responsible for assessing and managing Barclays’ risks from cybersecurity threats, and overseeing key areas that

include cybersecurity operations (including cyber threat intelligence), proactive defence (which includes penetration testing

and vulnerability management), security architecture and engineering, cyber posture and assurance (which includes third-

party security management), data security, and identity and access management. The Group CISO is also supported by a

team of CISOs and BISOs (Business Information Security Officers) for business units, regions and jurisdictions.

Chief Information Security Office leaders manage Barclays’ cybersecurity activities and are accountable for the day-to-day

monitoring of residual risk, identification of gaps, oversight of remedial actions and implementation of strategy. The Group

CISO has more than 25 years of experience managing cybersecurity for global financial institutions, leading large-scale

initiatives across all cybersecurity domains, including cyber defence, application security, vulnerability assessment, data

protection, third party risk, cyber resilience, and security engineering. The Group CISO and supporting leadership team

collectively have advanced degrees and senior level experience managing cybersecurity risks in a variety of sectors, including

those that represent critical national infrastructure, such as health care, telecommunications and financial institutions. They

are supported by teams of subject matter experts and analysts in a variety of specialisations.

Supporting the delivery of Barclays’ cyber and information security strategy are multiple management committees, forums,

and councils, including Cyber Control Councils for each of the 12 Standards supporting the Group Information and

Cybersecurity Policy (as more fully described below). These Cyber Control Standards Councils feed into the Cybersecurity

Risk Category Controls Forum, the Group Controls Committee, the Group Risk Committee, and ultimately the Board Risk

Committee. In addition, the Group Co-Chief Operating Officers hold business reviews that include management updates on

the status of cybersecurity across the Group, and a standalone Chief Operating Office Controls Forum that also escalates to

the Group Controls Committee. Barclays’ Operational Risk and Internal Audit functions provide independent views of cyber

risk management from second and third line of defence perspectives.

Barclays assesses its cybersecurity activities against the industry-recognised National Institute of Standards and Technology

(NIST) Cybersecurity Framework. Under Barclays' ERMF, there is an Information and Cyber Security Policy supported by 12

Standards which define the minimum requirements for cybersecurity matters across the Barclays Group.

The Policy is embedded into the Group's ERMF with Standards to implement cybersecurity risk management. The Standards

cover the following topics: Cryptography, Network Security, Security Configuration, Data Loss Prevention, Vulnerability

Management, Data Security, Incident Response & Threat Intelligence, Threat Management, Governance, Identity & Access

Management, Third Party Information and Cyber Security, and Application Security. The Group CISO approves and is

accountable for the Information and Cyber Security Policy and associated Standards. As part of our programme, we

periodically assess our performance against these Standards and identify areas for improvement and remediation.

The Barclays Group Board Risk Committee, within its oversight of Operational Risk as a principal risk, is responsible for

overseeing risks arising from cybersecurity threats. In 2025, the Group CISO provided updates to the Barclays Group Board

Risk Committee about cybersecurity risks facing the Group. Such updates addressed topics that included the cybersecurity

threat environment and ransomware attack preparedness, measurement of Barclays' risk and control posture, cybersecurity

incident trends and Barclays' response, plans to improve Barclays' ability to recover from a material cyber attack scenario,

Barclays’ vulnerability management, privileged access to Barclays' systems, and regulatory developments. In addition, the

Group Co-Chief Operating Officers provided updates to the Board detailing the progress being made to strengthen

cybersecurity capabilities and reduce risk across the organisation as the threat environment continues to evolve.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

The Barclays Group Board Risk Committee, within its oversight of Operational Risk as a principal risk, is responsible for overseeing risks arising from cybersecurity threats.

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

In 2025, the Group CISO provided updates to the Barclays Group Board

Risk Committee about cybersecurity risks facing the Group. Such updates addressed topics that included the cybersecurity

threat environment and ransomware attack preparedness, measurement of Barclays' risk and control posture, cybersecurity

incident trends and Barclays' response, plans to improve Barclays' ability to recover from a material cyber attack scenario,

Barclays’ vulnerability management, privileged access to Barclays' systems, and regulatory developments. In addition, the

Group Co-Chief Operating Officers provided updates to the Board detailing the progress being made to strengthen

cybersecurity capabilities and reduce risk across the organisation as the threat environment continues to evolve.

Cybersecurity Risk Role of Management [Text Block]