BATTALION OIL CORP 10-K Cybersecurity GRC - 2024-03-29

Page last updated on April 11, 2024

BATTALION OIL CORP reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-29 19:53:16 EDT.

Filings

10-K filed on 2024-03-29

BATTALION OIL CORP filed an 10-K at 2024-03-29 19:53:16 EDT
Accession Number: 0001558370-24-004422

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion. Our internal auditors perform audit engagements to assess our strategies, policies, procedures, and controls to reduce the risk of a cybersecurity incident. As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. With the assistance and advice of our expert consultants, responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our Director of Information Technology, who reports to our Chief Executive Officer. Governance Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into our compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee of the Board having certain responsibilities relating to risk management of cybersecurity. Among other things, the Audit Committee discusses with management the Company s major policies with respect to risk assessment and risk management, including cybersecurity, as they relate to the integrity of the Company s accounting and financial reporting processes and the Company s compliance with legal and regulatory requirement. In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company s operations. The Audit Committee receives quarterly reports from Company management, which includes cybersecurity risk factors. 39 Table of Contents The Board routinely receives information and updates from Company management and the Audit Committee with respect to the effectiveness of the Company s information systems security framework, which may include cybersecurity assessments, risk management, and mitigation measures. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A Risk Factors above.

Company Information