NORTH EUROPEAN OIL ROYALTY TRUST

The Trust is a grantor trust, conducts no active operations, has no customers, and maintains no personal or credit data. The Trust's processes for assessing, identifying, and managing material risks from cybersecurity threats are tailored to its specific circumstances. The Trust's cybersecurity protocols include, but are not limited to, programs with built-in technological features to prevent disruptions and intrusions, and isolated computer workstations. The Trust's personnel are aware of the potential of a cybersecurity incident and exercise caution to ensure no such incident occurs. The primary entities with which the Trust conducts business are banks, outside service providers, and vendors, which have their own cybersecurity protocols. Interactions between the Trust's information facilities and outside vendors or service providers involves a combination of passwords, passphrases, and two-factor or independent authorizations.

There have been no known cybersecurity incidents that have had a material impact, have materially affected or are reasonably likely to materially affect the Trust, including its business strategy, results of operations, or financial condition.

The Managing Director oversees the Trust's cybersecurity protocols and conducts regular discussions and reviews of such protocols with the Trust's Board of Trustees.