Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 323

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 16
Chunk 323
---
 Plan for the period 2025-2027. This plan outlines a comprehensive roadmap to achieve a cybersecurity maturity level that exceeds that of our peer companies. The plan presented in the Board of Directors meeting on December 17, 2024, outlines the primary action lines, categorized according to the domains established by the Spanish National Institute of Standards and Technology (“NIST”): governance, identification, protection, detection, response and recovery.In addition, we continuously carry out training and awareness initiatives related to security and privacy, promoting training and awareness campaigns for our employees. Some of the topics covered include protection of personal information, secure password management, device protection (laptops, smartphones, etc.), social engineering (phishing, smishing, vishing), malware and other technical attacks detection, detection of scams, security on online purchases and how to react if there is a security incident.As of the date of this annual report on Form 20-F, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incident, that materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 3 of Part I, “D. Risk Factors—Risks Relating to the Company and Our Business—Cyber-attacks or other privacy and data security incidents could disrupt our business and expose us to significant losses, liability and reputational damage.”
Governance
Our Board of Directors, through the Audit Committee, is responsible for supervising and evaluating the efficiency of the control and management on cybersecurity. Our Internal Audit and Enterprise Risk Management Department supports the Audit Committee in the fulfilment of this responsibility, which includes oversight of our threat landscape, posture, performance, and strategy related to cybersecurity. The Audit Committee is also charged with overseeing the cybersecurity incident trends and incidents that have been handled. Since no impactful incident occurred in 2024, no communication was made to the Audit Committee. In the event of an incident with impact, the Head of the Information Security Office would contact the Chief Digital and Information officer who will liaise with the relevant parties in the Executive Committee and Internal Audit to present the incident and impact. The same audience will be updated regularly about the root cause, and countermeasures implemented in addition to the upcoming audit committee meeting.
​

206

To support the deployment of the principles of our cybersecurity strategy and