Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 322

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 16
Chunk 322
---
 processes, considering logical and physical security, privacy and fraud management concerns, (ii) ensure compliance with the security and privacy by design principles; and (iii) improve client access control and authentication services related to online services, from a security and user experience perspective. Our commitment to cybersecurity is underscored by our ISO 27001 certification, reflecting our adherence to the highest standards of data security.To safeguard our digital infrastructure, we employ network segregation strategies, including enabled firewalls that isolate instruments from broader networks, permitting only authorized data streams. Our diagnostic systems utilize application whitelisting to block malware and ensure system integrity. Additionally, we encrypt connections and communications across information systems to maintain data confidentiality during transmission, using for instance Virtual Private Networks (VPN). We enforce stringent user access controls, ensuring that personnel access only the data necessary for their roles. In our product development, we integrate advanced cybersecurity measures to ensure that sensitive data is securely protected. This commitment extends to our diagnostic solutions, which are designed with features to provide peace of mind to our clients and stakeholders.Our approach includes continuous identification and assessment of cybersecurity risks that are thoroughly analyzed to determine the possible impact present and future. Third-party evaluations are conducted as part of the architecture and services evolution. We regularly engage multiple service providers to perform periodic reviews and evaluations of our cybersecurity posture. We share the results to the IT and the Executive committee as part of the regular updates. These reviews encompass a broad range of areas, including but not limited to information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor. We maintain a highly qualified cybersecurity team comprising management, information technology, and legal experts. 

205

In addition, SOC operation and incident response teams are delivered by top companies in the cybersecurity sector to ensure that the most appropriate profiles with deep knowledge in cybersecurity are available with the right capacity to handle the activities such as incident management, prioritization and incident resolution. When categorizing incidents, factors such as impact, number of users affected, type of information compromised, the threat actor involved, and sector trends are taken into consideration. Additionally, incidents are reviewed monthly in follow-up meetings with the vendor, shared in weekly IT committee sessions and discussed monthly in the cybersecurity council. Regular training programs for employees, executives, and directors are conducted to heighten awareness of cybersecurity risks and the importance of protecting sensitive and personal data. In alignment with our continuous improvement commitment, we have updated our Cybersecurity Director