Company: SNY
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0001121404-25-000010
Chunk: 311

Company: Sanofi
Filing Date: 2025-02-13
Form: 20-F
Chunk 311
---
 case of a cybersecurity incident. In addition, Sanofi’s employees, who are the main users of Sanofi’s digital assets, are regularly trained to face cybersecurity threats and attacks. In the event of a cyberattack, Sanofi has established a plan that includes criteria triggering the notification process for material cybersecurity incidents including from the cybersecurity operation center and the Chief Information Security Officer who can use the internal escalation channels to inform the management and the Board of Directors and, as appropriate, the relevant regulatory bodies. When dealing with third parties , our main commercial contracts include cybersecurity clauses aimed at ensuring such third parties comply with Sanofi’s cybersecurity rules and requirements, especially when providing services to and processing data from Sanofi. Additionally, Sanofi set up a vendor’s risk assessment program to evaluate the digital maturity of a vendor, which covers their business continuity as well as their related internal regulations, such as data privacy. As part of their contractual commitments major vendors and partners must report to Sanofi any cybersecurity incident that may have a significant impact for Sanofi. A dedicated process has been implemented for third parties’ networks interconnected with Sanofi’s network, aimed at limiting any propagation of a cyberattack to Sanofi’s digital assets. Sanofi’s cybersecurity risk management processes are integrated into its overall risk management system through its enterprise risk management process, which seeks to identify and address material risks to the organization. Each year, specific risk committees identify the risks that affect Sanofi’s local businesses in each country it operates and Sanofi’s global functions, such as Research and Development or Manufacturing and Supply. Although Sanofi has put in place the cybersecurity processes described above, Sanofi remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition (see “Item 3. Key Information — D. Risk Factors — Risks relating to our business — Breaches of data security, disruptions of information technology systems and cyber threats could result in financial, legal, competitive, operational, business or reputational harm ”). Governance Sanofi has appointed a Chief Information Security Officer who oversees Sanofi's information, cybersecurity, and technology security. Our current Chief Information Security Officer has been working for Sanofi in this capacity since 2014 and has seventeen years of experience in the cybersecurity industry, including eight years as the global head of cybersecurity at one of France’s largest telecommunications companies. The Chief Information Security Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents