RANGE RESOURCES CORP

We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements:

•

people – security awareness education and readiness-testing throughout the year for employees;

•

process –incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and

•

technology – investing in industry aligned security technology and threat intelligence capabilities.

Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts extensive ongoing reviews of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Our Director of IT Security is responsible for assessing, monitoring and managing risks from cybersecurity threats, overseeing our overall cybersecurity risk management program which includes prevention, mitigation, detection and remediation of cybersecurity incidents and supervises a team of cybersecurity personnel. Our Director of IT Security reports to our VP – Information Technology and is responsible for reporting material incidents to our Cybersecurity Risk Management Committee (“CRMC”) that includes officers charged with reporting responsibilities. Cybersecurity incidents that meet a pre-determined minimum threshold are communicated upward to executive officers to determine overall materiality and disclosure obligations. Our Director of IT Security keeps the CRMC apprised of our processes to prevent, detect, mitigate and remediate cybersecurity incidents at least annually. Our internal cybersecurity team led by our Director of IT Security has over 75 years of combined experience in information security and maintains several cybersecurity certificates.

We conduct security assessments, manage user access, perform vulnerability scanning and patching, oversee monitoring and carry out annual penetration testing, in addition to other critical security functions. In conjunction with our internal team, we utilize an independent third-party operations center that is focused on, but not limited to, monitoring alerts, logs, behavior analytics, vulnerability notifications and remediation guidance. Critical infrastructure is continuously monitored to ensure accessibility and appropriate security posture. We also perform reviews and risk analysis for third-party software and platforms which sets a standardized security baseline. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors, allowing us to increase security of our technology assets and our data. In addition, we perform an annual cybersecurity risk assessment of critical third-party systems.

Our board of directors oversees our cybersecurity risk and receives, at a minimum, a quarterly cybersecurity report and a bi-annual update from IT leadership, which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and ongoing cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.

To date, there have been no risks from cybersecurity threats because of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.