EASTMAN CHEMICAL CO

Risk Management and Strategy

Cybersecurity is an integral part of the Company's overall risk management program. The Company takes a comprehensive approach to cybersecurity, involving key stakeholders in oversight and decision-making processes.

The Company utilizes a risk-based, multi-layered information security strategy based on the US NIST and ISO 27001 to assess, identify, and manage risks from cybersecurity threats. This approach includes: (i) dedicated security operations center monitoring; (ii) network-based and host-based protections; (iii) a Privacy Council focused on privacy regulation adherence; (iv) privileged access management controls; (v) annual and ongoing information security training for all employees and targeted tabletop and other exercises; (vi) encryption of data, backup, recovery, and testing; (vii) regular internal and external audits against information security best practices; and (viii) benchmarking using external third parties. The Company employs these, and other measures, to protect its information assets and operations from internal and external cyber threats while ensuring business resiliency. It also aims to protect employee, customer and supplier information from unauthorized access or attack, as well as secure the Company's networks, systems, devices, products, and services.

The Company maintains cybersecurity policies, standards, and procedures, which include cyber incident response plans. These policies and procedures are continually refined to adapt to changes in regulations, identify potential and emerging security risks, and develop mitigation strategies and protocols for those risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities, and improve decision-making, prioritization, monitoring, and reporting. The Company also engages external parties, such as consultants, independent assessors, computer security firms, and risk management and governance experts, to enhance its cybersecurity oversight and mitigate third-party risks.

To date the Company has not experienced a cybersecurity incident that has materially affected its business strategy, results of operations, or financial condition. The Company maintains processes to asses the materiality of cybersecurity incidents, and where material, the Company will disclose such incidents via Form 8-K. See "Risk Factors - Risks Related to the Company's Business and Strategy" in Part I, Item 1A of this Annual Report.

Governance

The Board of Directors provides oversight of the Company's cybersecurity program. The Audit Committee, which consists of non-employee independent directors, receives updates from the Chief Information Officer ("CIO") or the Chief Information Security Officer ("CISO") on cybersecurity performance and recent industry trends at least quarterly. In addition to regular cybersecurity briefings from the Audit Committee, the Board also receives periodic, but at least annual, updates from management regarding cybersecurity, including prompt notice of cybersecurity threats or incidents that could materially impact the Company. The Board is informed about risk profile status, adversary assessments, training initiatives, cybersecurity projects, emerging global policies and regulations, cybersecurity technologies and best practices, cyber readiness, third-party assessments, mitigation efforts, and response plans.

The Company has a dedicated CIO and CISO who are supported by a team of cybersecurity professionals (the "Cybersecurity Team") that are responsible for leading the company-wide cybersecurity program and risk mitigation efforts. The CIO, CISO, and Cybersecurity Team work across all organizations within the Company to protect the Company and its employees, customers and suppliers against cybersecurity risks. The CIO and CISO, with over 35 and 25 years of experience, respectively, have cybersecurity expertise, coupled with experience in IT strategy, operational management, incident response, and business continuity maintenance.

The Company also has a cross-functional Cybersecurity Incident Response Team consisting of senior-level management. This team is responsible for cybersecurity incident oversight and meets as needed, depending on the nature of an incident. The Company's internal audit team also provides independent assurance on the overall operations of the Company's cybersecurity program. The Company ensures that all employees, including part-time and temporary employees, undergo cybersecurity training and compliance programs at least annually.