We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. We have designed and implemented an Access Control Policy. The policy and supporting procedures encompass all information systems that are owned, operated, maintained, and controlled by the Company and all other information systems, both internally and externally, that interact with these systems. Our cybersecurity program and policies is a collaborative effort, requiring commitment from all personnel, including management, internal employees and users of information systems, along with vendors, contractors, and other relevant third parties.

Our Chief Information Security Officer (“CISO”) and Information System Security Officer (“ISSO”) are responsible for providing overall direction, guidance, leadership, and support for the entire information systems environment, while also assisting other applicable personnel in their day-to-day operations. The CISO and ISSO are to report to other members of senior management on a regular basis regarding all aspects of the organization’s information systems posture. Our internal employees and users are responsible for adhering to the organization’s information security policies, procedures, practices, and not undertaking any measure to alter such standards on any information systems. Additionally, end users are to report instances of non-compliance to senior authorities, specifically those by other users. End users – while undertaking day-to-day operations – may also notice issues that could impede the safety and security of our information systems and are to also report such instance immediately to senior authorities. Our vendors, contractor and other third-party entities are responsible for adhering to the organization’s information security policies, procedures, practices, and not undertaking any measure to alter such standards on any such system components.

We have also implemented an IT Security Incident Response Policy. Incident response preparation comprises of how to respond to incidents and how to protect against and detect computer-related incidents. The process of providing incident response is identified by four distinct phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication and recovery; and (iv) post-incident activity. Our CISO and ISSO are responsible for developing, implementing, coordinating, and maintaining IT security policy and procedures. These individuals also fill the role of Computer Incident Response Team (CIRT) Leaders. They are responsible for the operations of the system and its applications, including reporting, responding to security incidents, and ensuring that adequate event logging is enabled. Our ISSO is responsible for the security of the system and for ensuring incident response (IR) policy and plan are documented, followed, that the IR plan is tested annually, updated with lessons learned from training exercises and on-going incident handling activities, and periodically reviewed at least on an annual basis. This person also fills the role of Deputy CIRT Leader. Our CISO is responsible for information security within the organization and is responsible for the review and approval of the incident response policy and plan. General end-users and non-CIRT personnel are responsible for actively securing their systems and notifying the CIRT of any suspected information security incident (e.g., potential virus detection, phishing emails, potential malware infection, etc.).