AGILENT TECHNOLOGIES INC

Agilent is committed to maintaining a secure environment for our data, complying with applicable legal requirements, and effectively supporting our business objectives and customer needs. Our cybersecurity strategy emphasizes the cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention, detection of, and response to cybersecurity threats.

Key Elements of Our Cybersecurity Program. We maintain cybersecurity policies that articulate Agilent's expectations and requirements regarding technology use, data privacy, risk management, and incident management. Regular exercises and assessments against recognized cybersecurity frameworks are conducted to improve the effectiveness of our processes. These are conducted by third party organizations in addition to internal audit teams. Cybersecurity is considered the responsibility of every Agilent employee, with regular education and best practice sharing to raise awareness of threats. Layered controls are implemented to prevent and detect cybersecurity threats, with policies and processes designed to provide timely notifications and compliance with legal requirements. These include controls to assess third party suppliers and their services.

Governance and Oversight. Our cybersecurity program under the Chief Information Officer ("CIO") is led by our Chief Information Security Officer ("CISO"). The Board of Directors delegates oversight of cybersecurity risks to the Audit Committee, which receives updates from the CISO and CIO at least annually. Cybersecurity is integrated into the risk management process for the company through various mechanisms, including quarterly business reviews, annual budget planning, and linkage to the Enterprise Risk Management ("ERM") process.

As of the date of this report, we do not believe any risks from cybersecurity threats have materially affected Agilent, including our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be any incidents in the future or that they will not materially affect us as outlined in Item 1A. Risk Factors.