Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 324

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 16
Chunk 324
---
 processes, we have created and implemented the Information Security Process and Management System (the “ISMS”). The ISMS is based on the appropriate definition of objectives, roles and responsibilities, policies and procedures, and technology to: (i) identify cybersecurity threats and related risks; (ii) protect critical assets; (iii) detect and respond to cybersecurity threats and cybersecurity incidents; and (iv) recover business services due to a cybersecurity incident.Our Head of the Information Security Office (“ISEC”) reports to the CDIO and has the authority to develop and implement our cybersecurity policies, standards, procedures, and oversee the implementation and effectiveness of the ISMS. Our Head of the ISEC has more than 20 years of experience in cybersecurity practice, working for nine years in risk management practice in a “big four” accounting firm, serving as chief Information Security Officer and Data Protection Officer. She is a Telecommunication Engineer and has been awarded with CISA, CISM and ISO Lead Auditor 271001 certifications, among others. She is also member of the ISMS forum (La Asociación Española para el Fomento de la Seguridad de la Información), in Spain and participates in multiple roundtables to stay connected to the latest cybersecurity trends. Our Chief Digital information officer has more 27 years of experience working across multiple sectors for top 100 fortune companies such as IBM, Procter and Gamble, HP and Deutsche Post DHL. We are also in the process of selecting and appointing the members for our new Global Cybersecurity Committee. This committee will facilitate the alignment of cybersecurity initiatives with business objectives; ensure global coverage of the ISMS; collaborate in the prioritization and execution of security initiatives and projects; and promote a culture of protection against cybersecurity threats throughout the Grifols Group entities. This committee will be comprised of representatives of business units, information technology and legal personnel, as well as operations and services areas.In addition to periodic meetings with representatives from various areas, including lawyers, accountants and information technology specialists, as well as a continually open line of communications, the Head of ISEC and the CDIO update the Audit Committee at least twice per year regarding the control and management on cybersecurity.
​
​

207

PART III