Company: TAK
Filing Date: 2025-06-25
Form Type: 20-F
Source: 0001395064-25-000095
Chunk: 213

Company: TAKEDA PHARMACEUTICAL CO LTD
Filing Date: 2025-06-25
Form: 20-F
Item: Item 16K
Chunk 213
---
Item 16K. Cybersecurity

Risk management and strategy

Cybersecurity Risk Management Framework

Takeda maintains a cybersecurity controls framework designed to identify, protect from, detect, respond to and recover from cybersecurity threats consistent with the U. S. Department of Commerce’s National Institute of Standards and Technology (NIST) Cybersecurity Framework. Preventive control measures are deployed across Takeda’s application, cloud, end-user device, networking and manufacturing infrastructure. Takeda’s Chief Information Security Officer (“ CISO”) oversees our cybersecurity risk management framework, reporting to the Chief Data and Technology Officer (“ CDTO”). Our CISO has over 30 years of experience in information technology, including more than 10 years serving in a CISO capacity at companies in various industries, including pharmaceuticals.

Experienced and trained cyber risk professionals in the Cybersecurity & Risk team (“ TCR”) within Takeda’s global data, digital & technology function (“ DD& T”), many of whom hold certifications from established cybersecurity organizations

TCR risk professionals assess identified risks for their perceived severity of impact on Takeda and likelihood of occurrence, and design and implement appropriate responsive measures in collaboration with relevant business units. TCR provides to the CISO on a monthly basis, and to other members of DD& T senior management on a quarterly basis, operational reports regarding the number and nature of cyber incidents detected and the status of controls and program enhancements. Cybersecurity risk management is integrated into Takeda’s Enterprise Risk Management (“ ERM”) program and addressed as a principal risk in our annual Enterprise Risk Assessment, which is reported to the RECC and the Board of Directors, each of which is responsible for approving the reported risks and associated mitigation plans, as well as assessing the effectiveness of the mitigation.

While Takeda’s cybersecurity risk management program is principally directed by TCR risk professionals, during the fiscal year ended March 31, 2025, Takeda initiated a multi-year program to invest further in its cybersecurity capabilities in part through the retention of a third-party managed security service provider (MSSP) The MSSP is responsible for facilitating cybersecurity operations, incident response and access management activities involving Takeda personnel and other third parties in a centralized and coordinated manner to enhance the effectiveness and efficiency of Takeda’s cybersecurity program. TCR risk professionals oversee the MSSP and remain principally responsible for cybersecurity risk management. Takeda also engages with other third parties for its cybersecurity program on an as-needed basis, including with respect to technical consulting and third-party