{"url_path":"/sec/rdhl/10-k/2026/item-16k","section_key":"item-16k","section_title":"Item 16K ****CYBERSECURITY**","topic":"sec","document":{"doc_type":"20-F","doc_date":"2026-04-27","source_url":"https://www.sec.gov/Archives/edgar/data/1553846/0001104659-26-049055-index.html","accession_number":"0001104659-26-049055","cik":"0001553846","ticker":"RDHL","issuer_name":"RedHill Biopharma Ltd.","edgar_url":"https://www.sec.gov/Archives/edgar/data/1553846/0001104659-26-049055-index.html","primary_entity_key":"0001553846","primary_entity_name":"RedHill Biopharma Ltd."},"word_count":782,"has_tables":true,"body_markdown":"**ITEM 16K.        ****CYBERSECURITY**\n\n​\n\nWe operate in the biopharmaceutical industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect all required information and prevent data loss and other security breaches, including a cybersecurity risk assessment program.\n\nOur current cybersecurity risk assessment program consists of an annual review of the technical safeguards that have been implemented to ensure they align with industry best practices and evolving risks. As part of this program, we leverage the advice of third-party consultants and auditors to help us assess and identify risks from cybersecurity threats, including the threat of a cybersecurity incident, and manage our risk assessment program. Among other things, these providers perform regular audits, ongoing monitoring of network traffic and system logs for suspicious activity, periodic employee training on cybersecurity best practices, and implementation of encryption protocols for sensitive data. Our cybersecurity risk assessment program outlines governance, policies and procedures and technology to oversee and identify risks from cybersecurity threats, and we are informed by previous cybersecurity incidents we have observed both within the Company and in our industry. All cyber incidents are reported to a designated RedHill email after a review by our Security Operation Center (“SOC”). Such emails contain a full description as to what has happened and how the incident was mitigated.\n\nOur management, with assistance of our virtual Chief Information Security Officer (“vCISO”), is responsible for the day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The individuals currently serving in these roles are Razi Ingber, our CFO, and Eli Migdal, Founder and Head of Cyber Security for Migdal Computing Solutions LTD. Migdal Computing Solutions LTD also provides us with certain cybersecurity services, including vCISO, Security Operation Center, risk assessment,  risk quantification, server-level penetration testing, planning, deployment and management of most modern cybersecurity solutions. Pursuant to our cybersecurity risk assessment program, our vCISO is notified about every cybersecurity event, and as the vCISO he approves the actions that were taken and transforms SOC cases to be marked as completed.\n\nOur Board of Directors is responsible for the oversight of risks from cybersecurity threats in conjunction with our Audit Committee. Our Board of Directors and our Audit Committee receive from time to time reports and updates from our management with respect to the management of risks from cybersecurity threats. Such reports cover the Company’s information technology security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape. Additionally, the Board of Directors and Audit Committee consider risks from cybersecurity threats as part of their oversight of the Company’s business strategy, risk management, and financial oversight.\n\n166\n\n[Table of Contents](#TOC)\n\nWe also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service providers. We require any third party to comply to with such our policies and procedures, which include, but are not limited to:\n\n1.  When vendors connect into our system, they undergo the same “identity protection” process as Redhill users, including mandatory multi-factor authentication and conditional access.\n\n2.  We require any active third-party supplier to work with Single Sign On in our system, using our identity provider, all except the financial SAP system in which we separate from information technology by design.\n\n3.  We inquire about the supplier disaster recovery ability, and in some cases we will provide our own additional backup of the materials. For example, we backup our email mailboxes to external storage servers.\n\nAs of the date of this Annual Report, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. To the best of our knowledge and ability, we have attempted to preemptively mitigate the financial impact of any cybersecurity incident.  For further information on how a cybersecurity threat might affect us, see also Item 3D. Risk Factors – General Risks – “Our business is subject to cybersecurity risks.”\n\n​"}