VOC Energy Trust

​

may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.

ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon’s risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.

BNY Mellon’s Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.

Risk Management Oversight and Governance

BNY Mellon’s management is responsible for assessing and managing BNY Mellon’s material risks from cybersecurity threats with oversight provided by its Board of Directors (the “Board”) and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon’s risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon’s cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.

At the management level, BNY Mellon’s Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon’s significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the “CIO”) and its members include the CISO.

BNY Mellon’s Technology Risk Committee is the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of defense risk function. It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity incidents and remediation plans. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is chaired by the interim Chief Technology Risk Officer. Members include key leaders from the first line of defense, including the CISO.

BNY Mellon’s CIO, CISO and interim Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon’s CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon’s CIO joined BNY Mellon in September 2024 from a large multinational company, where she was responsible for overseeing information technology and cybersecurity operations. BNY Mellon’s interim Chief Technology Risk Officer joined BNY Mellon in November 2024 and has previous experience as Global Head of Cyber, Technology and Information Security Risk Management at a global systemically important financial institution and over a decade of experience serving the U.S. intelligence community in a variety of cybersecurity-related positions.

Item 2. Properties.

Reference is made to “Item 1. Business — Description of the Underlying Properties” and “Item 7. Trustee’s Discussion and Analysis of Financial Condition and Results of Operations — Planned Development and Workover Program,” which are incorporated herein by reference.