LINCOLN ELECTRIC HOLDINGS INC

Risk Management and Strategy

Our cybersecurity risk management process is integrated into our Enterprise Risk Management “ERM” process as described in Item 1A. Risk Factors. Cybersecurity has been identified as a critical risk.

To identify, assess, and manage material cybersecurity risks, we regularly evaluate and take steps to enhance our cybersecurity protocols to protect against or mitigate cyber threats. We conduct third-party and internal assessments of our environments, including system penetration testing, test our recovery and response processes, and we consider industry standards when developing our information security program. The Company has an information security training program, which calls for training all computer-based employees twice per year, through various employee training modules relative to information security matters and phishing simulation events with employees to raise cybersecurity awareness.

From time to time, we engage third-party assessors, consultants, auditors and others to assist us with evaluating, enhancing, implementing and monitoring our cybersecurity risk-management programs. We maintain processes to oversee and identify cybersecurity risks associated with our use of third-party service providers such as vigilant contract and vendor due diligence review, as well as annual review of the service providers’ independent audit report where applicable.

Like many companies, our systems and those of our third party providers who provide us with services and products may be subject to cybersecurity threats and cybersecurity incidents. To date, no such cybersecurity incidents have had a material impact on our business or operations. However, if as a result of any future incidents or our systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity incident, we may suffer an interruption in our ability to manage and operate the business, and our results of operations and financial condition could be adversely affected. The Company maintains an insurance policy with respect to cybersecurity and has

undergone several simulation, preparedness and response exercises. See “Risks Related to Manufacturing and Operations” in Item 1A. Risk Factors.

Governance

Our Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. Our Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of our Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Information Officer (“CIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment. The CIO reports to the full Board about cybersecurity on an annual basis.

Lisa Dietrich is our CIO. Ms. Dietrich has 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. In her role as CIO, Ms. Dietrich is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, Ms. Dietrich chairs the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, Ms. Dietrich regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures. Ms. Dietrich utilizes this information in her reporting to the Board and Audit Committee of the Board.