Company: GNMSF
Filing Date: 2025-02-12
Form Type: 20-F
Source: 0001558370-25-000846
Chunk: 163

Company: GENMAB A/S
Filing Date: 2025-02-12
Form: 20-F
Item: Item 16K
Chunk 163
---
ITEM 16K CYBERSECURITY

Overview of Cybersecurity Program and Risk Management

Safeguarding the confidentiality, integrity, and availability of systems, data and applications as well as protecting trade secrets and data privacy is an essential pillar in ensuring the business continuity of Genmab, and complying with regulatory requirements, and maintaining the trust of our patients, employees, shareholders, partners, and other stakeholders. Genmab maintains a comprehensive cybersecurity program based on the National Institute of Standards and Technology’s NIST 800 Special Publication Information Security standard (“ NIST Standard”) for managing cybersecurity activities, including formulation of global objectives of the cybersecurity program andrisk identificationand mitigation activities.

Table of Contents

Genmab’s Information Security Department, led by the Global Head of Information Security and Information Technology Risk & Compliance Management, is responsible for administering and annually updating our enterprise-wide information security program. The program includes activities and projects in all six functions (govern, identify, protect, detect, respond, recover) of the NIST standard with the goal of further improving Genmab’s security profile and adapting, where needed, to changes in Genmab’s business strategy and threat environment. Input for the program comes from the annual attack and penetration test, periodic threat landscape and security maturity assessments, as well as requirements of applicable cybersecurity regulations. The Information Security Department is also responsible for a number of global security processes and services that Genmab undertakes, such as the following:
proposing and administering information security policies and standards;
security awareness training (including the administration of a third-party phishing learning platform, conducting periodic global security awareness events and preparing other learning materials);
security risk assessment of new and existing vendors, partners and other third parties with respect to whom a security risk assessment is deemed appropriate;
review of new contracts and assessment of the impact of new technologies on security;
security incident detection and management;
periodic operational security incident exercises, and vulnerability scanning.
We work with consultants andother third-partyadvisors to perform security services and conduct security assessments and independent audits of the security and resilience of our systems and networks. We have also established a cyber response task force consisting of leaders from Finance, Legal, Compliance, Communications, and Information Technology & Digital (“IT& D”) departments. The task force is responsible for cybersecurity crisis preparedness and the management of cybersecurity crisis situations. This task force regularly leads scenario exercises, which include engagement of all levels of management including members of Genmab’s Executive Committee, to assess Genmab’s resilience capabilities in the event of