SM Energy Co

Governance

Our Board of Directors, with assistance from the Audit Committee, oversees the Company’s enterprise risk management process, including with respect to relevant IT matters affecting the Company and management of risks arising from cybersecurity threats. Our Board of Directors has delegated the primary responsibility to oversee relevant IT matters affecting the Company, including cybersecurity risks and mitigations strategies, to the Audit Committee. The Audit Committee receives cybersecurity reports and regular updates from our Vice President and Chief Information Officer and our Director of Cybersecurity Risk and Business Continuity (“IT Management”), which includes, among other information, the steps management has taken and the specific guidelines and policies that have been established to monitor, control, mitigate and report exposure to cybersecurity risk. The Audit Committee regularly reports to the Board of Directors on relevant IT matters affecting the Company, including cybersecurity risks and mitigation strategies.

IT Management is responsible for assessing and managing cybersecurity risks and leads a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. This team regularly reports to IT Management, and IT Management regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. IT Management works closely with our legal department to oversee compliance with legal, regulatory and contractual security requirements.

During 2025, our Vice President and Chief Information Officer was a seasoned IT professional with over 30 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reported to our Executive Vice President and Chief Financial Officer until his retirement in January 2026. Our Director of Cybersecurity Risk and Business Continuity has over 25 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.

In January 2026, upon his retirement, our Vice President and Chief Information Officer,’s role was been assumed by our new Vice President of Information Technology who has over 20 years of IT experience,12 of which have been at the Company in progressive leadership roles.

We have adopted a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the “IRP”) to provide a standardized framework for responding to security incidents. The IRP outlines protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to executive management Audit Committee in a timely manner. We have also established a Cyber Incident Response Team (“CIRT”) led by IT Management, to provide an efficient, effective, and orderly response to technology related incidents. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

Risk Management and Strategy

We believe that mitigating cybersecurity risks is the responsibility of every employee. We are focused on building a resilient cybersecurity culture and strong IT and OT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include:

•monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks;

•ongoing mandatory training and testing, and utilizing other forms of social engineering awareness and education for our employees;

•using cybersecurity tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for detecting and alerting on known threats and anomalous behaviors;

•assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners;

•creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats;

•engaging third-party cybersecurity experts and consultants to perform penetration testing and scanning of our systems for vulnerabilities;

•obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and

•maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.

Our cybersecurity risk management program leverages the National Institute of Standards and Technology’s Cybersecurity Framework. We strive to employ cybersecurity best practices, including implementing new technologies to proactively monitor new threats and vulnerabilities and reduce risk; maintaining a Cybersecurity Incident Response Plan, Disaster Recovery Plan, and Business Continuity Plan; and regularly updating our response planning and protocols. We have integrated our cybersecurity processes into our overall enterprise risk management program, thereby establishing a comprehensive approach by which we determine and implement strategies designed to manage external, strategic, operational and financial risks to our business, including cybersecurity threats.

We utilize a wide range of protective cybersecurity technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. In addition, we use an information security risk management approach that includes monitoring security threats and trends in the industry, analyzing potential security risks that could impact the business, partnering with industry recognized security organizations, and coordinating an appropriate response should the need arise.

Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2025, 2024, and 2023, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, refer to Risk Factors in Part I, Item 1A of this report.

We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements, and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.