Company: IPHYF
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001598599-25-000042
Chunk: 303

Company: Innate Pharma SA
Filing Date: 2025-04-30
Form: 20-F
Item: Item 16K
Chunk 303
---
Item 16K. Cybersecurity

In order to assess, identify and manage material risks from cybersecurity threats, the Company maintains a cybersecurity roadmap, which includes processes for information technology, or IT, operations, technologies, business continuity and governance. The cybersecurity roadmap is based on an assessment performed by a third-party consultant.

To assess and manage material cybersecurity risks, the Company has established a dedicatedsteering committee, chaired by the Chief Financial Officer.

• defining the cybersecurity priorities,

• endorsing the cybersecurity roadmap and overseeing its execution,

• monitoring the ongoing implementation of our risk management strategy for IT infrastructure, systems, vendors, and regulatory compliance,

• tracking cybersecurity incidents, and

• preparing and overseeing mitigation plans implementation.

Employees at each level of the organization receive regular training sessions about cybersecurity risks. Moreover, the company relies on external specialists and vendors for technical matters for which the Company has limited skills or infrastructure. All external subcontractors and IT systems that manage sensitive processes or data are selected taking into account cybersecurity and data protection considerations, in particular by checking the certifications held by service providers or suppliers and performing, when appropriate, qualification and follow-up audits.

At Innate Pharma, cybersecurity risks are integrated within our overall risk management framework. Each year, the Vice President, Compliance & Operations gathers input from various stakeholders at the Company and identifies the risks facing our business and regularly presents the identified material risks, including cybersecurity risks to the Audit Committee. This reporting covers various matters, including the cybersecurity risks identified and proposed mitigation or preventative measures. Our risk assessment is performed regularly and is subject to change in case of any significant change or event during the year. In case of a significant cybersecurity incident, the cybersecurity steering committee would assess the incident severity, propose the appointment of an appropriate crisis unit and submit an action plan for the Executive Board’s endorsement. If the incident is considered as critical to the Company’s cybersecurity, the incident will be escalated to the Audit Committee and to the Supervisory Board.

As of the filing of this Form 20-F, the Company is not aware of any cyber-attacks that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Risk Factors - Risks Related to Innate Pharma's Organization and Operations” in Item 3. D. of this Annual Report.

PART III