GENERAL ELECTRIC CO

CYBERSECURITY. The description in this section reflects GE’s approach as of December 31, 2023; we anticipate that, following the planned spin-off of our GE Vernova businesses, each of GE Aerospace and GE Vernova will continue to evolve their cybersecurity risk management, strategies and governance to meet their respective needs as standalone companies.

CYBERSECURITY RISK MANAGEMENT AND STRATEGY. GE has developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST or ISO 27001.

2023 FORM 10-K 26

Our key cybersecurity processes include the following:

•Risk-based controls for information systems and information on GE’s networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on GE’s networks, including customer information, personal information, intellectual property and proprietary information.

•Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. GE’s cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise and business levels.

•Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at GE. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations and industry risks.

•Supplier risk assessments: We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for GE to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. GE also seeks contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect GE information that is processed on their systems.

•Third-party assessments of GE: We have third-party cybersecurity companies engaged to periodically assess GE’s cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats.

We also consider cybersecurity, along with other top risks for GE, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We face certain ongoing risks from cybersecurity threats—including heightened threats in connection with the separation of GE HealthCare in January 2023 and the planned separation of GE Aerospace and GE Vernova into independent companies—that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to the Risk Factors section (Cybersecurity - Increased cybersecurity requirements, vulnerabilities, threats and more sophisticated and targeted computer crime, as well as cybersecurity failures, pose risk to our systems, networks, products, solutions, services and data..) for additional information about these risks.

CYBERSECURITY GOVERNANCE. The Audit Committee of the GE Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE’s practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from GE’s Global Chief Information Security Officer (CISO) and other internal digital technology and cybersecurity leaders on cyber threats and our cybersecurity risk management strategy. The Audit Committee also receives information about cybersecurity risks as part of GE’s enterprise risk management framework and reporting.

GE’s Global CISO reports to GE’s Global Chief Information Officer and leads the Company’s overall cybersecurity function. The Global CISO has over 20 years of experience in managing and leading IT or cybersecurity teams and participates in various cyber security organizations. The Global CISO collaborates with business unit CISOs to identify and analyze cybersecurity risks to GE; consider industry trends; implement controls, as appropriate and feasible, to mitigate these risks; and enable business leaders to make risk-based business decisions that implicate cybersecurity considerations. The Global CISO meets with senior leadership to review and discuss GE’s cybersecurity program, including emerging cyber risks, threats and industry trends. The Global CISO also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public or private sources to inform our cybersecurity technologies and processes.