Company: SNY
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0001121404-25-000010
Chunk: 310

Company: Sanofi
Filing Date: 2025-02-13
Form: 20-F
Chunk 310
---
 foreign jurisdictions that prevent inspections N/A Item 16J. Insider Trading Policies Sanofi has adopted a Global Operating Procedure on the Prevention of Insider Trading governing the purchase, sale, and other dispositions of securities by directors, senior management, and employees that is reasonably designed to promote compliance with applicable insider trading laws, rules and regulations, and any applicable listing standards. A copy of the policy is included as Exhibit 11.1. Item 16K. Cybersecurity Risk Management and Strategy Sanofi has implemented a cybersecurity strategy i nvolving various dedicated personnel and resources aimed at preventing, detecting and responding to cyberattacks, as well as being able to recover promptly in the event of material impact following a cyberattack. Additionally, Sanofi has set up various cybersecurity proces ses applicable to subsidiaries within the Sanofi group. Sanofi regularly updates its cybersecurity processes to address cybersecurity trends and threats. Cybersecurity processes have been established to address material cybersecurity risks, including in connection with the following areas: • information technology and solution usage; • access control; • patch management; • security on specific environments (i.e. cloud, virtualization, SAP, automated systems, IoT, etc.); • log management; • network security; • systems security standards; • remote access; • secure development of applications; • cryptography; • mobile devices; • third-party management (including cybersecurity requirements in contracts); and • incident management. Sanofi utilizes security standards and frameworks (i.e. the NIST framework) and has established cross-functional risk control capabilities to facilitate operational implementation aligned with its cybersecurity processes.

| 184 | SANOFIFORM 20-F2024 |

| PART II                 |
| Item 16K. Cybersecurity |

S anofi regularly analyzes its Internet-based services and performs regular penetration tests and attack simulations to assess the protections and the detections capabilities. The cybersecurity compliance status of computing assets connected to Sanofi’s network is routinely consolidated for Sanofi's business units, including within manufacturing, and research and development sites. Monthly dashboards are published and shared within Sanofi’s different business units and global functions. Sanofi implements corrective measures and improvement actions in response to these processes. Data classification and protection tools are in place, such as the implementation of a specific process and technology aimed at detecting and responding to abnormal data flows. Sanofi has set up a cybersecurity operation center in charge of detecting and responding to cybersecurity threats and attacks, as well as coordinating Sanofi-wide incident responses. Incident response trainings and simulations are run within Sanofi to seek to be better prepared in