VOC Energy Trust

​

Brazos or of its VOC Operators, VOC Brazos and its VOC Operators may not be successful in preventing cyber-attacks or mitigating their effect. Any cyber-attack could have a material adverse effect on the reputation, competitive position, business, financial condition and results of operations of VOC Brazos and its VOC Operators, and could have a material adverse effect on the Trust. Cyber-attacks or security breaches also could result in litigation or regulatory action, as well as significant additional expense to VOC Brazos and its VOC Operators to implement further data protection measures.

In addition to the risks presented to the systems and networks of VOC Brazos and its VOC Operators, cyber-attacks affecting oil and natural gas distribution systems maintained by third parties, or the networks and infrastructure on which they rely, could delay or prevent delivery to markets. A cyber-attack of this nature would be outside the ability of VOC Brazos and its VOC Operators to control, but could have a material adverse effect on the business, financial condition and results of operations of VOC Brazos and its VOC Operators, and could have a material adverse effect on the Trust.

Cyber-attacks or other failures in telecommunications or IT systems could result in information theft, data corruption and significant disruption of the Trustee’s operations.

The Trustee depends heavily upon IT systems and networks in connection with its business activities. Despite a variety of security measures implemented by the Trustee, events such as the loss or theft of back-up tapes or other data storage media could occur, and the Trustee’s computer systems could be subject to physical and electronic break-ins, cyber-attacks and similar disruptions from unauthorized tampering, including threats that may come from external factors, such as governments, organized crime, hackers and third parties to whom certain functions are outsourced, or may originate internally from within the respective companies.

If a cyber-attack were to occur, it could potentially jeopardize the confidential, proprietary and other information processed and stored in, and transmitted through, the Trustee’s computer systems and networks, or otherwise cause interruptions or malfunctions in the operations of the Trust, which could result in litigation, increased costs and regulatory penalties. Although steps are taken to prevent and detect such attacks, it is possible that a cyber incident will not be discovered for some time after it occurs, which could increase exposure to these consequences.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation (“BNY Mellon”), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2025 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

Risk Management Strategy and Procedures

BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon’s cybersecurity risk management program is embedded in its three lines of defense model.

As part of its first line of defense, BNY Mellon maintains a dedicated Cybersecurity organization, led by the Chief Information Security Officer (the “CISO”), that is responsible for the day-to-day management of risks from cybersecurity threats. Cybersecurity’s responsibilities include cybersecurity threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. Cybersecurity monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, Cybersecurity maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity risk management practices and compliance with BNY Mellon’s policies and procedures. The preparedness program includes mandatory training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises. In addition, BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness. BNY Mellon’s information security management system is certified to the ISO 27001 standard by an independent, accredited certification body, and BNY Mellon maintains this certification through periodic external audits and ongoing monitoring.

BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.

Cybersecurity is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon’s risk management framework and establishes guidance for Cybersecurity and management designed to help identify, assess and manage cybersecurity risk.

BNY Mellon’s Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.

Risk Management Oversight and Governance

BNY Mellon’s management is responsible for assessing and managing BNY Mellon’s material risks from cybersecurity threats with oversight provided by its Board of Directors (the “Board”) and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon’s risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon’s cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.

At the management level, BNY Mellon’s Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon’s significant technology projects and initiatives, reviews reports from management concerning Cybersecurity and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board and the full Board of Directors. The Technology Oversight Committee is chaired by the Chief Information Officer and Global Head of Engineering (the “CIO”).

BNY Mellon’s Technology Risk Committee is the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of defense risk function. It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity incidents and remediation plans. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Enterprise Risk Committee and the Risk Committee of the Board. The Technology Risk Committee is chaired by the Chief Technology Risk Officer. Members include key leaders from the first line of defense, including the CISO.