5E Advanced Materials Inc

Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks

Cybersecurity is integrated within the Company’s Enterprise Risk Management process, which is the Company’s systematic approach to identifying, managing and assessing major risk and safeguards, including cybersecurity. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Despite our efforts we put into maintaining a high level of cybersecurity, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

Key elements of our cybersecurity risk management program include but are not limited to the following:

Risk Assessment

We periodically conduct assessments of cybersecurity risks to identify potential vulnerabilities and threats to our systems and data. These risk assessments are designed to help identify material risks from cybersecurity threats to our critical systems and information.

Security Team

We have established a security team which is principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents.

Protection Measures

We implement and maintain cybersecurity controls, including firewalls, access controls, and intrusion detection systems, to safeguard our systems and data from unauthorized access, use, or disclosure. Furthermore, we use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.

Incident Detection and Response

We have established a cybersecurity incident response plan that includes procedures for responding to relevant cybersecurity incidents. These protocols include incident response plans and escalation procedures to minimize the impact of potential breaches.

Cybersecurity Training and Awareness

All new hires receive cybersecurity awareness training. All employees, including incident response personnel and senior management, receive periodic training and are periodically subject to evaluations to confirm their cybersecurity knowledge and awareness.

Third-Party Risk Management

We have implemented a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

Material Cybersecurity Incidents

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See “Risk Factors” within this report when evaluating our business and related risk.

Cybersecurity Governance

The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management’s actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company’s cybersecurity, information security, and information technology risks. On an annual basis, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company’s policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.

Recognizing the importance of cybersecurity to the success and resilience of our business, the Board of Directors considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, our Chief Financial Officer holds discussions on cybersecurity risks and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

Given the size of the Company, we do not employ individuals with significant experience and relevant backgrounds in information security, cyber risk management, and cyber incident response. However, we contract with third-party vendors who have these backgrounds. These backgrounds include relevant degrees, certifications, and relevant work experience, including in roles responsible for cybersecurity oversight in entities similar to us, and our Chief Financial Officer relies on the expertise provided by these third-parties in carrying out his cybersecurity responsibilities.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.