Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Cybersecurity Risk Management and Strategy:

The Company implements a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its Information Systems as well as its critical data, including customers’ data.

TotalEnergies designs and evaluates its program based on the National Institute of Standards and Technology (NIST CSF), the ISO 27001 standard for information security management systems (ISMS), and communicates with the French information security agency (ANSSI) for certain scopes of action.

The Company’s cybersecurity risk management program is integrated into TotalEnergies’ overall risk management program and rely on common methods, reporting channels, and governance processes that apply to other risk areas such as legal, compliance, strategic, operational, and financial risk.

The key elements of the cybersecurity risk management program include, but are not limited to:

●

Risk assessments,

●

A cybersecurity team primarily responsible for managing risk assessment processes, cybersecurity controls, and response to cybersecurity incidents,

●

Cybersecurity training and awareness for the Company’s employees,

●

A cybersecurity incident response plan including procedures, and

●

A risk management process for key service providers.

In addition to these key elements, the Company develops and relays rules to be followed everywhere regarding cybersecurity. It raises awareness and trains its employees on cybersecurity through various initiatives, such as mandatory training, courses tailored to different profiles, and guidelines for managers. Regular events like phishing awareness campaigns or Cybersecurity Month organized by the Company in October allow all employees to review best practices and identify cyber correspondents.

Cybersecurity Risk Management Processes Integrated [Text Block]

TotalEnergies designs and evaluates its program based on the National Institute of Standards and Technology (NIST CSF), the ISO 27001 standard for information security management systems (ISMS), and communicates with the French information security agency (ANSSI) for certain scopes of action.

The Company’s cybersecurity risk management program is integrated into TotalEnergies’ overall risk management program and rely on common methods, reporting channels, and governance processes that apply to other risk areas such as legal, compliance, strategic, operational, and financial risk.

The key elements of the cybersecurity risk management program include, but are not limited to:

●

Risk assessments,

●

A cybersecurity team primarily responsible for managing risk assessment processes, cybersecurity controls, and response to cybersecurity incidents,

●

Cybersecurity training and awareness for the Company’s employees,

●

A cybersecurity incident response plan including procedures, and

●

A risk management process for key service providers.

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. (See section 3.1.3 of Chapter 3 of the 2025 Universal Registration Document, starting on page 135.)

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Audit Committee (the Committee)

Cybersecurity Risk Role of Management [Text Block]

On an operational level, the management team which includes the Chief Security Officer (CSO), the Chief Information Officer (CIO), the Company Chief Security Officer (C-CISO), and the Branch Chief Information Security Officers (B-CISOs), is responsible for the assessment and management of material risks from cybersecurity threats. This team is in charge of the overall cybersecurity risk management program and oversees both internal staff and external consultants working on cybersecurity. The relevant experience of our management team includes the following:

●

The CSO is a former French general of the National Gendarmerie, who led the Gendarmerie Intervention Group (GIGN) and directed counter-terrorism operations.

●

The CIO has over 20 years of experience in information systems at TotalEnergies.

●

The C-CISO is the former head of EUROPOL (for 11 years), a former colonel of the French Gendarmerie, and the former head of the National Criminal Intelligence Service.

Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

On an operational level, the management team which includes the Chief Security Officer (CSO), the Chief Information Officer (CIO), the Company Chief Security Officer (C-CISO), and the Branch Chief Information Security Officers (B-CISOs), is responsible for the assessment and management of material risks from cybersecurity threats. This team is in charge of the overall cybersecurity risk management program and oversees both internal staff and external consultants working on cybersecurity. The relevant experience of our management team includes the following:

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.