Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 321

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 16
Chunk 321
---
 Our insider trading policy and procedures are included in our Internal Code of Conduct in Matters Relating to The Securities Market that is attached to this annual report as Exhibit 11.1.
​

204

Item 16.KCYBERSECURITY
Risk Management and Strategy
Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and is designed to facilitate coordination across different departments of the Grifols Group in the handling of such cybersecurity threats and incidents. This framework takes a risk-based approach to cybersecurity, aligning with internationally recognized frameworks, including NIST (National Institute of Standards and Technology) and ISO 27001, and includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and, as later explained in greater detail, informing management and our Board of Directors of material cybersecurity threats and incidents. Our Security Operations Center (SOC) and our Incident Response team (IRT) operate 24 hours per day, providing continuous monitoring across our data centers, perimeters, and workstations. The SOC utilizes a Security Information and Event Management (SIEM) system, which processes alerts and enables rapid detection and response of cybersecurity incidents. Additionally, our cyber-intelligence capabilities track emerging threats, allowing for proactive mitigation strategies.As cyberattacks evolve and become more sophisticated, we have strengthened our prevention and monitorization efforts. During the past few years, we ramped up cybersecurity and information security measures with the aim to ensure an adequate protection of our information and the assets supporting business processes. Our Chief Digital Information Officer (“CDIO”) is tasked with accelerating our companies’ use of digital platforms, data science and new technologies to transform and strengthen critical business activities such as relationships with plasma donors and customers as well as manufacturing operations, the development of new therapeutics and cybersecurity.Our Cybersecurity Policy aims to strengthen our digital security framework. The policy focuses on maintaining secure and resilient systems, continuously assessing and mitigating cybersecurity risks, implementing protective measures, and adapting to technological changes. It also ensures effective incident response and regulatory compliance, supports a qualified cybersecurity team, provides training for employees and executives, and fosters collaboration with industry peers and government agencies. We have adopted security measures in the past few years intended to: (i) ensure end-to-end protection of business