Company: HMDCF
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001410578-25-000377
Chunk: 638

Company: HUTCHMED (China) Ltd
Filing Date: 2025-03-19
Form: 20-F
Item: Item 16K
Chunk 638
---
ITEM 16K. CYBERSECURITY

Cybersecurity risk management is an
integral
part of our overall enterprise risk management program. Our cybersecurity risk management program is designed based on N. I. S. T cybersecurity framework.
This framework includes steps for (a) identifying cybersecurity threats, assessing the severity, identifying the source and whether the threat is associated with a
third-party service provider; (b) reporting material cybersecurity incidents to management and our board of directors; (c) implementing safeguards, countermeasures and mitigation strategies; and (d) remediation and restoration of the affected systems. Our cybersecurity team also engages third-party security experts for defense protection capability assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

Table of Contents

Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors.
The audit committee
is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.
The audit committee also reports material cybersecurity risks to our full board of directors.

Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of an IT Working Group established by the audit committee consisting currently of Dr. Dan Eldar, Non-executive Chairman, Mr. James Lai, Head of Corporate Internal Audit for CKHH, and Mr. Cheng Chig Fung, Johnny, Chief Financial Officer and Executive Director, who receive reports from our cybersecurity team led by theHead of IT and Security and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents.

Our Head of IT and Security and dedicated IT personnel are experienced information systems security professionals and information security managers with more than 15 years of relevant experience.
The IT Working Group regularly updates the audit committee on the company
’
s cybersecurity programs, material cybersecurity risks and mitigation strategies and provides cybersecurity reports quarterly that cover, among other topics, third-party assessments of the company
’
s cybersecurity programs, developments in cybersecurity and updates to the company
’
s cybersecurity programs and mitigation strategies.

In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However