Company: GLPG
Filing Date: 2025-03-27
Form Type: 20-F
Source: 0001558370-25-003806
Chunk: 330

Company: GALAPAGOS NV
Filing Date: 2025-03-27
Form: 20-F
Item: Item 16I
Chunk 330
---
agos information security risk environment to various Company stakeholders (internal control, data privacy, quality and compliance teams). Currently, the CISO position is held by an individual with over 20 years of work experience in life sciences IT management positions, and who previously had responsibility over information security and risk management.

We have also established a cross-functional Cybersecurity Disclosure team (“ CSD team”) and Cybersecurity Disclosure board (“ CSD board”) to oversee and manage the prioritization of risks from cybersecurity threats. The CSD team is comprised of the CISO and members of Galapagos’ legal and internal control teams. The CSD team members have experience in cybersecurity, legal and financial reporting. The CSD board is comprised of the CISO, the Senior Director, Head of Internal Control & Finance Operations, the General Counsel, and the Chief Financial Officer and Chief Operating Officer. The CSD board members have experience in the areas of cybersecurity, legal, data protection, internal control and finance.

Table of Contents

The Company’s Board of Directors is responsible for the oversight of our risk management activities, and has delegated to the Audit Committee the responsibility to assist our Board in this task. While our Board of Directors oversees our risk management, our Executive Committee is responsible for day-to-day risk management processes.

Specifically,
Galapagos’
Audit Committee is responsible for evaluating Galapagos’ system of internal control and risk management, including the cybersecurity risk management program and related controls. The CISO and the Head of IT review risks from cybersecurity threats and incidents with the Audit Committee during an annual review, and report incidents that require escalation per set procedures. The Audit Committee is responsible for the final approval of any disclosure of a material cybersecurity incident.

TheExecutive Committee is responsible for setting up and maintaining policies related to the risk profile of the Company and its systems to identify, assess, manage and monitor cybersecurity risks.

PART III

Item 17 Financial statements

Not applicable.

Item 18 Financial statements

See pages F-1 through F-72 of this annual report.

Item 19 Exhibits

The Exhibits listed in the Exhibit Index at the end of this annual report are filed as Exhibits to this annual report.

Table of Contents

Index to the Consolidated Financial Statements

FINANCIAL SECTION

Audited consolidated financial statements as of December 31, 2024 and 2023 and for the years ended December 31, 2024, 2023 and 2022.

Contents

  Report of Independent Registered Public Accounting Firm – BDO Bedrij