LINCOLN ELECTRIC HOLDINGS INC

Risk Management and Strategy

Our cybersecurity risk management process isintegrated into our ERM process as described in Item 1A. Risk Factors. Cybersecurity has been identified as a critical risk.

To identify, assess, and manage material cybersecurity risks, we regularly evaluate and take steps to enhance our cybersecurity protocols to protect against or mitigate cyber threats. We conduct third-party and internal assessments of our environments, including system penetration testing, test our recovery and response processes, and we consider industry standards when developing our information security program. The Company has an information security training program, which calls for training all computer-based employees through various employee training modules relative to information security matters and phishing simulation events with employees to raise cybersecurity awareness.

From time to time, we engage third-party assessors, consultants, auditors and others to assist us with evaluating, enhancing, implementing and monitoring our cybersecurity risk-management programs. We maintain processes to oversee and identify cybersecurity risks associated with our use ofthird-party service providers such as contract and vendor due diligence review, as well as annual review of the service providers’ independent audit report where applicable.

Like many companies, our systems and those of our third party providers who provide us with services and products may be subject to cybersecurity threats and cybersecurity incidents. To date, no such cybersecurity incidents have had or are reasonably likely to have a material impact on our Company, including its business strategy, results of operations or financial condition. However, if as a result of any future incidents our systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity incident, we may suffer an interruption in our ability to manage and operate the business, and our results of operations and financial condition could be adversely affected. The Company maintains an insurance policy with respect to cybersecurity and has undergone several simulation, preparedness and response exercises. See “Risks Related to Manufacturing and Operations” in Item 1A. Risk Factors.

Governance

Our Board oversees the management of our risks, including risks from cybersecurity threats, on an enterprise-wide basis, and the Lead Independent Director promotes our Board’s engagement in this process. Our Board has delegated oversight of the risk assessment and mitigation process with respect to cybersecurity to the Audit Committee of our Board. The Audit Committee regularly monitors the Company’s cybersecurity risks and receives updates from the Chief Information Officer(“CIO”) at each meeting. In addition, the Audit Committee regularly reviews the overall effectiveness of the information technology security environment as part of quarterly updates provided by the CIO. The CIO reports to the full Board about cybersecurity on an annual basis.

Our CIO has over 25 years of experience in the Information Technology (“IT”) and cybersecurity industry. The CIO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. On at least a quarterly basis, the CIO chairs the IT Governance Committee, which includes the executive management team. The purpose of this committee is to inform and make strategic decisions on IT-related matters, including the prevention, detection, mitigation and remediation of cybersecurity incidents. In addition, the CIO regularly reviews key cybersecurity risk metrics and reporting designed to measure the effectiveness of related processes and procedures as part of quarterly updates to the Audit Committee. The CIO utilizes this information in her reporting to the Board and Audit Committee of the Board.