HALLIBURTON CO

We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities isintegrated into our enterprise risk management program and enterprise risk assessment process. This provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. We engage our internal information technology (IT) audit group to audit our information security programs, and the results are reported to our executive management and the Audit Committee of our Board of Directors. We also engage third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, such as the National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and International Electrotechnical Commission 62443.

In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying information technology infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our information security policies and standards are assessed by our Information Security Governance team. Any critical and high-risk levels that are identified are then documented and reported to relevant key stakeholders.

Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy requires that all software vendors and IT related service providers submit to an IT security and governance review and obtain formal approval by our Information Security Governance team before it can be used.

We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cybersecurity incident, an Incident Response Team will assess the cybersecurity incident’s impact as the basis for assigning a preliminary severity rating. This team then provides the Chief Information Security Officer (CISO) with a summary and preliminary severity rating and the CISO subsequently notifies the Chief Information Officer (CIO) as appropriate. The CISO and CIO will assess situational information and business impact to finalize the severity rating. The CISO is then responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our management and Cyber Incident Response Leadership, our Chief Executive Officer would notify our Board of Directors. Should any incidents occur that have a preliminary severity rating of high or critical, our Cyber Incident Response Leadership would confer with our Cybersecurity Disclosure Committee to determine whether to report the cybersecurity incident in our public filings.

Aside from more immediate reporting of material incidents to our Board of Directors as described above, our CISO provides our Board of Directors an update on cybersecurity during each of its quarterly meetings. This update includes data on certain cybersecurity metrics, information on internal and third-party cybersecurity incidents, and general discussion of cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CIO and CISO, which includes in-depth updates on our cybersecurity program and strategy including cybersecurity risks.

The CIO leads all components of our IT functions. Our CIO has over 20 years of experience with Halliburton and has had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO, who reports directly to our Executive Vice President of Administration and Chief Human Resources Officer, has over 20 years of technology and cybersecurity experience across global enterprises, risk advisory, and incident response firms.

We have experienced cybersecurity incidents and attempted breaches in the past, one of which resulted in an unauthorized third party gaining access to certain of our systems and exfiltrating information from those systems, which we determined was a material event as previously disclosed in a Form 8-K we filed with the SEC on September 3, 2024. The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our operations and corporate functions, required us to incur significant costs, and required a significant amount of attention from management and our work force. Related to this incident, we face risks of unknown impacts or new events, regulatory actions, or potential litigation, which could affect our business, reputation, or consolidated financial condition. Further, if our systems, or our customers’ or suppliers’ systems, for protecting against cybersecurity incidents prove to be insufficient, a future cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under General Risk factors in Item 1(a) Risk Factors.