Company: INCR
Filing Date: 2025-05-01
Form Type: 20-F
Source: 0001641172-25-007971
Chunk: 170

Company: Intercure Ltd.
Filing Date: 2025-05-01
Form: 20-F
Item: Item 16K
Chunk 170
---

ITEM   CYBERSECURITY
16K.                
--------------------
 
We have developed and maintain a cybersecurity risk management program, consisting of cybersecurity policies, procedures, compliance and awareness programs to mitigate risk and to ensure compliance with security, availability and confidentiality trust principles. The cybersecurity process has been integrated into our overall risk management system and process, and is solely internally managed. Management is responsible for identifying risks that threaten achievement of the control activities stated in the management’s description of the services organizations systems. Management has implemented a process for identifying relevant risks that could affect the organization’s ability to provide secure and reliable service to its users. The risk assessment occurs annually, or as business needs change, and covers identification of risks that could act against the company’s objectives as well as specific risks related to a compromise to the security of data. See “Item 3.D — Risk Factors — General Business Risks and Risks Related to Our Financial Condition and Operations — If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches that disrupt our operations or result in the unintended dissemination of protected personal information or proprietary or confidential information, or if we are found by regulators to be non-compliant with statutory requirements for the protection and storage of personal data, we could suffer a loss of revenue, increased costs, exposure to significant liability, reputational harm and other serious negative consequences”.
 
The level of each identified risk is determined by considering the impact of the risk itself and the likelihood of the risk materializing and high scoring risks are actioned upon. Risks are analyzed to determine whether the risk meets company risk acceptance criteria to be accepted or whether a mitigation plan will be applied. Mitigation plans include both the individual or department responsible for the plan and may include budget considerations.
 
The oversight of cybersecurity threats is undertaken by our Vice President of Operations and is supported by management, relying on leading service providers in the field. Our audit committee is responsible for cybersecurity oversight and monitoring risk. Management informs the audit and investment committee of such risk by committee meetings.
 
We have not, to our knowledge, experienced any material IT system failures or any material cybersecurity attacks to date. See “Item 3.D — Risk Factors — General Business Risks and Risks Related to Our Financial Condition and Operations— If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches that disrupt our operations or result in the unintended dissemination of protected personal information or proprietary or confidential information, or if we are found by regulators to be non-compliant with statutory