HALLIBURTON CO

We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to

cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our

strategic priorities isintegrated into our enterprise risk management program and enterprise risk assessment process. This

provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate

associated risks. We engage our internal information technology (IT) audit group to audit our information security programs,

and the results are reported to our executive management and the Audit Committee of our Board of Directors. We also engage

third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, including the

National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and

International Electrotechnical Commission 62443.

In managing material risks from cybersecurity threats, we require a security and technical architecture review for all

new software and applications, and for all changes to the underlying IT infrastructure that manages, processes, stores, or

transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our policies

and standards are assessed by our IT & Information Security Governance processes. Any critical and high-risk levels that are

identified are then documented and reported to relevant key stakeholders.

Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated

with our use of third-party service providers. Our policy requires that each third-party service provider go through a mandatory

IT & Information Security Governance processes review and obtain formal approval from our IT & Information Security

Governance groups before it can be used.

We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a

cybersecurity incident. In the event there is a cyber security incident, an Incident Response Team will assess the cybersecurity

incident’s impact as the basis for assigning a preliminary severity rating. This team then provides the Chief Information

Security Officer (CISO) with a summary and preliminary severity rating and the CISO subsequently notifies the Chief

Information Officer (CIO) as appropriate. The CISO and CIO will assess situational information and business impact to finalize

the severity rating. The CISO is then responsible for communicating incidents to other members of management as appropriate.

Were a cybersecurity incident to occur that was determined to be material by our management and Cyber Incident Response

Leadership, our Chief Executive Officer would notify our Board of Directors. Should any incidents occur that have a

preliminary severity rating of high or critical, our Cyber Incident Response Leadership would confer with our Cybersecurity

Disclosure Committee to determine whether to report the cybersecurity incident in our public filings.

Aside from more immediate reporting of material incidents to our Board of Directors as described above, our CISO

provides our Board of Directors with an update on cybersecurity during each of its quarterly meetings. This update includes

data on certain cybersecurity metrics, information on internal and third-party cybersecurity incidents, and general discussion of

cybersecurity risks. In addition, our Audit Committee receives a detailed update annually from the CISO, which includes in-

depth updates on our cybersecurity program and strategy including cybersecurity risks.

The CIO leads all components of our IT functions. Our CIO has over 20 years of experience with Halliburton and has

had numerous global assignments across all areas of IT delivery, operations, and management. Our CISO, who reports directly

to our Executive Vice Presidentand Chief Administrative Officer, has over 25 years of experience in the areas of operations,

infrastructure and applications, solution and demand design.

We have experienced cybersecurity incidents and attempted breaches in the past, one of which resulted in an

unauthorized third party gaining access to certain of our systems and exfiltrating information from those systems, which we

determined was a material cybersecurity incident as previously disclosed in a Form 8-K we filed with the SEC on September 3,

2024. The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our

operations and corporate functions, required us to incur significant costs, and required a significant amount of attention from

management and our workforce. Related to this incident, we face risks of unknown impacts or new events, regulatory actions,

or potential litigation, which could affect our business, reputation, or consolidated financial condition. Further, if our systems,

or our customers’ or suppliers’ systems, for protecting against cybersecurity incidents prove to be insufficient, a future

cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. See

additional information about our cybersecurity risks under General Risk Factors in Item 1(a) Risk Factors.