Canopy Growth Corp

The Company’s Audit Committee is responsible for overseeing the Company’s internal controls including oversight over our risk management program and cybersecurity. Management is responsible for the day-to-day administration of the Company’s risk management program and its cybersecurity policies, processes, and practices. The Company’s cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization and are standalone from the Company’s overall risk management system and processes. The Company seeks to address all material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company’s information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

Cybersecurity Risk Management and Strategy

The Company’s cybersecurity risk management strategy focuses on several areas:

•

Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company’s program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner.

•

Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security incudes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party incident response retainer to assist us in the event of an incident, Security playbooks, and recovery procedures also form part of our incident response capabilities. We do conduct Red Team/ Blue Team exercises with 3rd parties to help us assess our resiliency and the performance of our capabilities. We have also implemented various technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications.

•

Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company’s response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

•

Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems.

•

Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company’s employees with effective tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes, and practices.

The Company conducts periodic assessment and testing of the Company’s policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. On the basis of the monthly report, the CFO with the support of the VP, Information Technology evaluate and report to the Audit Committee. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.

Governance

The Audit Committee oversees the Company’s risk management program, including the management of cybersecurity threats. The Audit Committee receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company’s approach to overseeing cybersecurity threats with the Company’s CFO and other members of senior management.

The VP, Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company’s incident response and recovery plans. To facilitate the success of the Company’s cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

The VP, Information Technology has been with our Company for over five years in the roles of Director, Global IT Engineering & Sr Director, Global IT Engineering. Prior to joining our Company, the VP, Information Technology was the founder, President and CEO of RjR Innovations, a North American industry leader in IT Service Management. Throughout his 27-year career within the Information Technology industry, he has been an ITIL Best Practice Conference Speaker & Keynote Speaker at several events. The VP, Information Technology is supported by the Senior Director Cybersecurity & IT Risk who has over ten years in a senior cybersecurity leadership role. He holds certifications in CISM (Certified Information Security Manager) from ISACA and PCIP (Payment Card Industry Professional) from the PCI Security Standards Council.

Material Effects of Cybersecurity Incidents