Magnera Corp

Governance

Our Chief Information Officer (CIO) has over 30 years of experience in cybersecurity and has primary management oversight of the Company’s cybersecurity and cyber risk management activities. The CIO administers our cyber risk assessments, oversees ongoing risk management processes, and regularly reports to the Audit Committee. During fiscal 2025, the Audit Committee received regular briefings from the CIO on cybersecurity matters, including updates on current and emerging threats, progress on information security initiatives, assessments of the Company’s cybersecurity program, and the results of internal and third-party evaluations.

Risk Management and Strategy

Risk Assessment

Global cybersecurity threats and targeted attacks are an evolving risk to data, infrastructure, and overall operations. These risks are addressed through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cyber security threats and effectively responding to cybersecurity incidents when they occur.

Cybersecurity Assessments

We engage third parties to perform assessments of our cybersecurity programs, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Targeted security assessments were conducted and penetration tests throughout the year by internal teams as well as through engagement with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

Effects and Impacts of Cybersecurity Risks

As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. (See Item 1A. Risk Factors).