---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

The cybersecurity governance and programme are defined in a charter approved by executive management, which is anchored in a risk-based approach based on industry standards to balance the level of cybersecurity against the risks to Novo Nordisk.

At Novo Nordisk, cybersecurity risk management is an integral part of our enterprise risk management framework defined in our information security framework. The framework aligns with industry best practice covering IT infrastructure, IT systems, and third-party service providers, and includes steps for identifying and assessing the severity of a cybersecurity threat, evaluating the potential business impact, implementing countermeasures and mitigation strategies, and informing executive management of material cybersecurity threats and incidents. Risks are consolidated across business areas and integrated into the enterprise risk management framework, where the likelihood and impact of cybersecurity risk scenarios are evaluated for risk treatment by executive management and reported to the Board of Directors. The cybersecurity risk management programme is validated through peer-benchmarked

---

maturity assessments, external technical assessments of the core infrastructure, key applications and operational processes, as well as group internal audit evaluations of the cross-organisational controls implementation.

The Board of Directors has overall oversight responsibility for our risk management, and is charged with oversight of our threat landscape, posture, performance, and strategy related to cybersecurity. The Audit Committee is charged with overseeing the cybersecurity incident trends and potentially significant incidents that have been handled. Executive management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programmes.

Novo Nordisk cybersecurity programmes and teams are under the direction of our Chief Information Security Officer (CISO) in alignment with the strategic direction set by executive management. Novo Nordisk CISO is a senior IT executive with extensive experience in IT infrastructure and IT operations, and relevant experience in information security. Our teams are comprised of certified and experienced information systems security professionals and information security managers.

Novo Nordisk cybersecurity teams monitor, detect, contain, respond to and report upon cybersecurity threats, events, and incidents in collaboration with specialised third-party service providers. This covers processes for handling major cybersecurity incidents, which is integrated into the corporate crisis management framework for management of large-scale cyber events. Management, including the CISO and our cybersecurity teams, regularly reports on cybersecurity to various organisational levels including submitting regular reports to the Audit Committee and Board of Directors.

---

---

---

---

---

---