Yasser Korami

For 16 international and national group subsidiaries, in close collaboration with CISOs and Correspondent IT Directors:

● Assessment of subsidiaries' security maturity according to ISO 27002 practices (e.g., Audit report, maturity radar, and cyber roadmap, etc.)

● Planning and implementation of quarterly security committees within subsidiaries

● Support and training for CISOs on security topics

Within the BCP Group's security department:

● Implementation of centralized reporting on the security maturity level of subsidiaries

● Development of the Group's quarterly risk management committee

● Development of the annual committee for banking supervisors and regulators in the CEMAC, UEMOA, Indian Ocean, and Moroccan regions.

IT and Cybersecurity Risk Management: IT Risk Assessor

● Deployment of the Group's risk management approach at the local level with steering/coordination of the established system

● Development/Assessment of IT and cybersecurity risks in close collaboration with affected business units and IT assets

● Identification, Monitoring, and management of risk mitigation action plans with IT asset owners (e.g., IT assets, external providers, group business units, etc.)

● Migration of the previously deployed risk management system to the centralized ServiceNow tool – IT Risk GRC module

● Organization and facilitation of the monthly IT & cybersecurity risk monitoring committee (CIO, CISO, key stakeholders)

● Presentation of the major risk map to the executive committee (General Management, business units, CIO)

● Development of the quarterly IT Cybersecurity risk report for the bank and for Bank Al Maghrib

IT and Cybersecurity Audit

● Steering and execution of IT & cybersecurity audits for critical suppliers, in accordance with the BNPP framework and group security requirements: Payment and check processing provider, Hosting and data center service provider, Bank card issuing and processing provider, Application maintenance service provider.

● Support for PCI DSS compliance and certification: implementation of processes and drafting of certification documentation

● Permanent IT and security control (level 2) with the IT department and business units

● Assistant CISO

● IT and security audit of critical external suppliers - Ref: ISO 27001 and client Framework