LUXFER HOLDINGS PLC

Overview

Luxfer recognizes that as business-efficiency demands lead to a more digitized world, cybersecurity and privacy risks have become critical business issues. Luxfer understands the systemic nature of these threats to the safety of our Company, customers, and employees. Consequently, Luxfer has integrated cybersecurity risk management into our broader enterprise risk management processes. Luxfer is committed to safeguarding and protecting our information technology (“IT”) network, equipment, and systems against cybersecurity threats to ensure our security and reduce risk.

Process and Standards

We devote significant resources to network security, data encryption, monitoring, and system maintenance. Our cybersecurity program is aligned with best practices, specifically the DFARS / NIST 800-171 IT Security Standard for US Government Contractors, reflecting our global operational footprint. During the year, we further strengthened our defense strategy through the enterprise-wide implementation of Sophos Endpoint Detection and Response (EDR) solutions, enhancing our real-time threat analysis and mitigation capabilities across our network. To ensure long-term success, we are committed to discovering and preparing for potential threats through the following mechanisms:

•Incident Response: We maintain an incident response plan that establishes procedures for reporting and handling cybersecurity events.

•Audits and Assessments: We perform periodic security audits and assessments, regularly engaging qualified independent third parties to assess our cybersecurity maturity and control environment.

•Third-Party Risk: We depend on third-party vendors for firewalls, virus solutions, and backups. To manage this risk, our IT professionals perform due diligence and risk analyses on vendors, verifying security testing prior to software installation.

As of the date of the filing of this Form 10-K, we are not aware of any successful attempts by third parties to gain access to our systems that have had, or are reasonably likely to have, a material effect on our business, operations, or financial condition. Although no incidents have been material to date, we recognize that cyber-attacks are becoming more sophisticated and our network remains potentially vulnerable.

Governance

Objectives

We will continually review and update our existing governance, policies, and practices, when necessary, to address the following objectives:

•Business Continuity, Availability, and Asset Protection: Ensure continuous business operations and safeguard the availability, integrity, and confidentiality of technology, data, intellectual property, and network infrastructure assets.

•Cybersecurity Resilience and Incident Management: Strengthen cyber-resiliency by enhancing controls for the rapid detection, mitigation, and effective response to cybersecurity incidents.

•Compliance and Data Governance: Maintain comprehensive compliance with all applicable external regulations (such as GDPR) and internal policies, including requirements for customer and employee confidentiality and privacy.

Board of Directors Oversight

The Board of Directors is responsible for overseeing cybersecurity, information security, and technology risk as part of its regular risk oversight function. The Board, comprised of independent Non-Executive Directors and one Executive Director, receives regular reports on information security matters from the Senior Leadership team at least quarterly as it is their responsibility to oversee Management's actions to identify, access, mitigate and remediate material risk.

Management's Role

The cybersecurity program is managed by our IT Steering Committee, which maintains the vision, strategy, and operation of the program.

•Committee Structure: The Committee is chaired by a member of the executive leadership team and includes IT Managers from across the company.

•Operational Responsibility: Local IT teams, managed by IT Managers, are responsible for the day-to-day implementation and monitoring of IT policies within their respective business units.

•Expertise: IT personnel are qualified within their respective roles and are provided with the resources necessary to carry out their responsibilities.

Human Capital and Training

Luxfer view it’s employees as a key line of defense. In addition to global policies covering IT security standards, Luxfer maintains a comprehensive, mandatory compliance training program. This includes:

•Policy Attestation: Employees must review applicable IT policies and attest to their understanding and agreement to comply.

•Phishing Simulations: The IT Steering Committee conducts internal phishing simulations to test employee reactions and collect metrics, such as click rates, to pinpoint trouble spots and target additional training.

Risks

Luxfer is committed to discovering and preparing for all potential cybersecurity threats. We set out below certain mitigating actions that we believe help us manage our principal cybersecurity risks.

Technical and Operational Risk

Luxfer's operations are dependent on IT systems. A successful cyber-attack (including disruption to the network, systems, and services) could inhibit business operations, impacting sales, production, and cash flows. Furthermore, reliance on third-party vendors for core services (e.g., firewalls, backup solutions) introduces external risk if their measures are compromised.

Management of Risk:

•Layered Defense: Implementation of technical controls including firewalls, threat monitoring systems, protected cloud architecture, and frequent security patching.

•System Integrity: Phasing out vulnerable operating systems, updating legacy servers with advanced security features, and ensuring core operating data applications are fully backed up.

•Vendor Due Diligence: Our IT professionals perform thorough due diligence and risk analysis on all third-party vendors, verifying sufficient security testing before software installation and regularly monitoring access permissions.

Human and Employee Risk

Employees represent a key vulnerability, as advancing cyber-attacks and phishing scams may lead to failure in recognizing threats or relying solely on automated defenses.

Management of Risk:

•Mandatory Training: Global policies cover IT security standards, and a comprehensive, mandatory compliance training and awareness program educates all employees on threat recognition and incident reporting.

•Phishing Simulations: Internal phishing simulations are continuously carried out to engage employees, raise awareness, and collect metrics (e.g., click rate) to pinpoint trouble spots and target additional, specific training where needed. All results are reported to the Senior Leadership Team.

Regulatory and Assessment Risk

Non-compliance with regulations, such as the UK General Data Protection Regulation (GDPR), which governs personally identifiable information security, can result in significant fines or litigation following a data breach.

Management & Controls:

•Compliance Framework: We make every effort to comply with GDPR and other applicable regulations through best practices, including annual review of the Data Protection Policy and implementation of secure systems and access control measures.

•Audits and Assessments: Periodic security audits and assessments are performed across the cybersecurity program. We regularly engage qualified independent third parties to assess cybersecurity maturity, review the security control environment, and ensure operating effectiveness.