AMC ENTERTAINMENT HOLDINGS, INC.

​

CORPORATE GOVERNANCE

​

Corporate Governance Guidelines

Our Corporate Governance Guidelines and Principles reflect the principles by which the Board operates and sets forth director qualification standards, responsibilities, compensation, evaluation, orientation and continuing education, board committee structure, chief executive officer performance review, management succession planning and other policies for the governance of the Company. A copy of the Corporate Governance Guidelines and Principles is available on our website at www.amctheatres.com under “Investor Relations”—“Governance”—“Governance Documents.”

Risk Oversight

The Board executes its oversight responsibility for risk management directly and through its committees, as follows:

The Audit Committee has primary oversight responsibility with respect to the Company’s annual enterprise risk management analysis, including financial and accounting risks. The Audit Committee discusses with management the Company’s significant financial and non-financial risk exposures and the Company’s risk assessment and risk management policies. Management provides the Audit Committee periodic assessments of the Company’s risk management processes and systems of internal control. The Chairperson of the Audit Committee reports to the full Board regarding material risks as deemed appropriate.

The Board’s other committees oversee risks associated with their respective areas of responsibility. For example, the Compensation Committee considers the risks associated with our compensation policies and practices, with respect to both executive compensation and employee compensation generally. The Board is kept abreast of its committees’ risk oversight and other activities via reports of the committee chairpersons to the full Board. These reports are presented at every regular Board meeting and include discussions of committee agenda topics, including matters involving risk oversight.

The Board, together with its committees, considers specific risk topics, covering the range of material risks to the Company, including risks associated with our annual operating plan, our capital structure, our strategic initiatives, compliance, human capital management, the environment and climate change, information systems and technology, privacy, and other cyber security risks. The Board and its committees regularly review our risk management policies, processes, and controls. In addition, the Board receives reports from the members of our senior leadership team that include discussions of the risks and exposures involved in their respective areas of responsibility. Further, the Board is informed of developments that could affect our risk profile or other aspects of our business.

Cybersecurity Risk

The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to assess, identify, and manage material risks from cybersecurity (including cybersecurity threats associated with the use of third-party service providers), to safeguard our information systems, and to protect the confidentiality, integrity, and availability of the data on our information systems.

Managing Material Risks & Integrated Overall Risk Management

The Company has strategically integrated cybersecurity risk management into our broader risk management framework. Management has formed cross-functional risk and information security committees (the “Security Committees”) to initiate, develop, review and implement cybersecurity policies, procedures and training to mitigate cybersecurity risks. Our information technology (“IT”) cybersecurity leadership team works closely with our Security Committees and internal audit team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

Using a risk-based prioritization approach, the IT cybersecurity leadership team and the Security Committees focus on securing our high value assets, updating our cybersecurity detection and prevention capabilities to identify new threats, and improving compliance processes to protect the Company’s operations and data. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations.

The Company has also implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and vulnerability and patch management.

Risk Management Personnel

The Company’s senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company’s senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company’s IT cybersecurity leadership team, comprised of the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC SVP & Chief Information Officer, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.

Monitoring Cybersecurity Incidents

The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the National Institute of Standards and Technology framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to prompt remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.

Engagement of Consultants for Risk Management Services

Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts to perform a variety of functions for the Company. These include, but are not limited to, cybersecurity audits, targeted ransomware assessment and table-top exercises, red and purple team attack simulations, internal penetration tests and other internal and external audits. These partnerships enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.

Overseeing Third-Party Risk

Because we are aware of the risks associated with third-party service providers, the Company implements processes to oversee and manage these risks. The Company utilizes software products and services to monitor and protect the Company’s environment from possible third-party breaches impacting the Company’s environment. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Third-parties who have access to highly sensitive information due to services performed and data retained are subject to increased scrutiny.

Risks from Cybersecurity Threats

We have not experienced any cybersecurity incidents that we believe have materially affected, or are likely to materially affect, the Company.

Board of Directors and Audit Committee Oversight

Our Board understands the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.