EAGLE MATERIALS INC

RISK MANAGEMENT AND STRATEGY

The Company continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

Managing Material Risks and Integrated Overall Risk Management

The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs, and industry-accepted standards, such as National Institute of Standards and Technology frameworks.

The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to:

•

maintaining a defined and practiced incident response plan;

•

maintaining cyber insurance coverage;

•

employing appropriate incident prevention and detection safeguards;

•

maintaining defined disaster recovery procedure and employing disaster recovery software, where appropriate;

•

educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and

•

reviewing and evaluating new developments in the cyber threat landscape.

Engaging Third Parties on Risk Management

Recognizing the complexity and evolving nature of cybersecurity risk, weengage with a range of external security support providers, including cybersecurity consultants, in evaluating, monitoring, and testing our cyber management systems and related cyber risks. The Company’s collaboration with these third parties includes threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.

Managing Third-Party Risk

We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.

Risks from Cybersecurity Incidents

To our knowledge, the Company has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations, or financial standing.

GOVERNANCE

Risk Management Personnel

The Company’s cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company’s cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 39 years of IT experience, 34 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC 2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.

Monitor Cybersecurity Incidents

Our DIT is continually informed and updated on the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. Our DIT, supported by our DIS, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan, which details immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

Board of Directors Oversight

The Audit Committee of the Company’s Board is responsible for overseeing the Company’s policies and practices related to cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including:

•

current cybersecurity threat landscape and emerging threats;

•

status of ongoing cybersecurity initiatives and strategies;

•

incident reports and learning from unique cybersecurity events, including those of other companies; and

•

compliance status and efforts with regulatory requirements and industry standards.

In addition, the CFO provides updates to the full Board upon request, and timely updates regarding unique developments such as regulatory updates or vulnerability developments, based on details provided by the DIT and DIS.