Company: GLPG
Filing Date: 2025-03-27
Form Type: 20-F
Source: 0001558370-25-003806
Chunk: 329

Company: GALAPAGOS NV
Filing Date: 2025-03-27
Form: 20-F
Item: Item 16I
Chunk 329
---
Item 16I Disclosure Regarding Foreign Jurisdictions that Prevent Inspections

Not applicable.

Table of Contents

Item16J Insider Trading Policies

We have adopted the a Dealing Code (“the Dealing Code”), which governs, among others, the purchase, sale and other dispositions of our securities by Directors, members of the Executive Committee, Employees and their family members. The Dealing Code is designed to ensure compliance with U. S. and European insider trading laws and regulations. The Dealing Code is filed as an exhibit to this annual report.

Pursuant to applicable Belgian law, we are not allowed to acquire our own securities.

Item 16K Cybersecurity

Cybersecurity Risk Management and Strategy

We have made significant efforts and investments to increase our cybersecurity posture. We currently maintain an information security risk management framework designed to protect the Company from risks from cybersecurity threats. This framework is informed by a security controls matrix that incorporates elements of an industry-standard cybersecurity framework. Our risk management framework operationalizes risk management principles designed to identify and assess upcoming risks, and assign the risks to risk owners with appropriate mitigation steps. We also conduct internal and external penetration testing and vulnerability assessments, and engage third-party cybersecurity experts to conduct periodic cybersecurity risk assessments.

We
are in the process of implementing a new enterprise risk management framework, tailored to the size and structure of the Company, to help us identify risks that should be reported/escalated to senior management. This new framework includes a risk forum that discusses changes in the risk environment, including key cybersecurity risks identified and managed by the IT Security function. The Head of IT Security is a standing member of the forum.

We also maintain written information security policies and procedures designed to ensure confidentiality, integrity and availability of the Galapagos data and IT systems. Our incident response plans and playbooks address clearly identified control objectives, which are based on industry standards, and have been operationalized in policies, procedures and work instructions. We have also engaged an external security partner to support us on a broad set of cybersecurity activities the daily management of our security operations and on-demand services.

Cybersecuritythreats associated with the use of third-party vendors are managed and overseen through specific policies and procedures. Each vendor is evaluated on their cybersecurity risk, and remediation programs for identified risks are set up and periodically reviewed based on the initial assessment.

Governance Related to Cybersecurity Risks

The
Chief Information Security Officer (“ CISO”)
is responsible for our information security risk management process, and reports periodically on the Galap