Cybersecurity risk management is an integral part of Guardian’s governance and management practices and is implemented through a structured approach designed to protect the confidentiality, integrity, availability, and authenticity of Guardian’s network and information systems. Guardian’s cybersecurity risk management processes are integrated into its overall risk management framework: cybersecurity risk is considered as part of the Audit Committee’s review of the adequacy and effectiveness of Guardian’s internal control policies and systems and of its procedures for the identification, assessment, management and reporting of risks (see Item 6.C), and is reviewed by the board of directors at least annually alongside the other principal risks facing Guardian’s business. Guardian’s approach relies principally on an external IT service and cybersecurity firm with an international presence (the “IT Firm”), which Guardian engages to manage its IT systems and cybersecurity, and on the Administrators (as defined below), who act as Guardian’s principal points of contact with the IT Firm. Other than the IT Firm, Guardian does not currently engage any assessors, consultants, auditors or other third parties in connection with its cybersecurity risk management processes. The IT Firm provides statistics on attempted suspicious login attempts and malicious emails received and quarantined, as well as vulnerability assessments of Guardian’s information systems on a monthly basis, and reports the results to the Administrators. The Administrators are tasked with overseeing and identifying risks from cybersecurity threats associated with Guardian’s use of third-party service providers, including the IT Firm and the providers of Guardian’s cloud-based email, file storage and accounting systems. The Administrators discharge this responsibility principally through their review of the IT Firm’s monthly reports and the quarterly calls described below, and the IT Firm in turn monitors the security of the third-party applications and services used by Guardian.

The Guardian board of directors retains ultimate responsibility for the approval and oversight of the Company’s cybersecurity risk-management measures in accordance with applicable regulatory requirements. The board of directors has not delegated oversight of cybersecurity risk to any committee of the board although the Audit Committee considers cybersecurity risk as part of its review of Guardian’s internal controls and risk management procedures described above. The board of directors is informed about cybersecurity risks through an update from the Administrators when required, and at least annually and, as described below, is informed promptly of any significant cybersecurity incident. The board of directors is supported by three designated administrators (the “Administrators”), being the chair of the Audit Committee, the Chief Executive Officer and the Commercial Operations Manager, who act as the principal points of contact with the IT Firm on all IT systems and cybersecurity matters. The Chief Executive Officer and Chief Financial Officer are the members of management responsible for assessing and managing Guardian’s material risks from cybersecurity threats, supported by the Administrators and the IT Firm. The Administrators report any cybersecurity issues to the board of directors and Chief Financial Officer by exception. None of the Administrators or the Chief Financial Officer holds a formal cybersecurity qualification or certification; the Administrators’ relevant experience consists of three years of managing Guardian’s IT systems and its relationship with the IT Firm. Guardian, including the Chief Executive Officer and the Chief Financial Officer, principally relies on the IT Firm’s expertise, which has provided and managed IT and cybersecurity services as a firm for ten years and holds ISO 27001 certification.

​

The IT Firm manages Guardian’s IT systems, including cybersecurity, antivirus software and file and data storage. The IT Firm is also charged with recommending best-in-practice security software programs. All new data access requests for new users require approval from one of the Administrators, and the Administrators are copied in on all emails from the IT Firm. Guardian is provided with monthly reports summarizing details, including the number of suspicious emails intercepted and any login attempts from unexpected locations. Management has quarterly calls with the IT Firm where potential improvements in systems and security are discussed, and Guardian is made aware of any new cyber threats that companies are being affected by. In the event of a cybersecurity incident, the IT Firm is required to notify the Administrators promptly, and the IT Firm and the Administrators are responsible for containing, mitigating and remediating the incident. Guardian does not currently maintain a formal written incident response plan, and responses are undertaken with recommendations and advice from the IT Firm. The Administrators escalate any significant cybersecurity incident to the board of directors and Chief Financial Officer, who, in consultation with Guardian’s legal and regulatory advisers, are responsible for assessing the materiality of the incident and for determining whether any public disclosure is required. Guardian also provides periodic cybersecurity awareness training to its directors, officers and employees, including in relation to phishing.