PERPETUA RESOURCES CORP.

Risk Management and Strategy

Information systems and other technologies, including those related to the Corporation’s information and operational technology systems, and its technical and environmental data, are an important part of the Corporation’s business activities. We must comply with certain elevated contractual requirements, including those related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DOW. We continue to implement cybersecurity processes designed to align with DOW requirements, instructions and guidance and work with the DOW as needed to assess cybersecurity risk and implement policies and practices aimed at mitigating identified risks as appropriate. Accordingly, the Company maintains processes for assessing, identifying and managing material risks from cybersecurity threats.

Such processes include the use of traffic monitoring tools, as well as training Corporation personnel to detect, report and prevent (where applicable) suspicious activity involving the Corporation’s IT systems and other technologies. We also employ monitoring mechanisms designed to help us detect and respond to cybersecurity threats. We conduct regular assessments and testing of the effectiveness of these controls, including security audits, incident response planning and regulatory compliance assessments. We seek to foster cybersecurity awareness and responsibility throughout the organization by regularly providing our employees with training on cybersecurity practices.

We use user access controls to limit unauthorized access to sensitive information and critical systems. In addition, we use multi-factor authentication for remote access, use of privileged accounts and access to critical systems. Encryption methods are used to protect sensitive data such as customer data, financial information and other confidential data. The implementation and management of these cybersecurity processes are integrated with the Company’s overall operational risk management processes, which seeks to limit our exposure to unnecessary risks across our operations.

We maintain an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. In accordance with the Company’s internal protocols, designated personnel in the management team are responsible for notifying relevant leadership, including senior management and the Board of Directors, of certain cybersecurity events that may significantly affect business operations. The Company’s procedures also involve:

We mayengage third party service providers including consultants and auditors in connection with the above processes. We recognize that third-party service providers may introduce cybersecurity risks.

Impacts from Cybersecurity Threats

As of the date of this Annual Report, though the Company and our service providers have been subject to certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. For additional information about the risks to our business associated with a breach or compromise to our information technology systems, see “Item 1A. Risk Factors – System security vulnerabilities, data breaches and cyberattacks could compromise proprietary or otherwise sensitive information or disrupt operations, which could adversely affect Perpetua Resources’ business, reputation, operations and stock price” above.

Governance

Our IT Systems Manager oversees our cybersecurity program and is responsible for identifying, assessing and managing cybersecurity risks to the Corporation. The IT Systems Manager reports directly to our CFO. Our IT Systems Manager holds an associate degree in computer application and support and has served in various roles in information systems administration for over ten years, including roles involving managing information technology and systems and implementing cybersecurity programs.

Our full Board and our Audit Committee oversee risks from cybersecurity threats and our cybersecurity practices and policies. Accordingly, our CFO periodically updates the Board and Audit Committee on cybersecurity matters, including cybersecurity risks. Additionally, our Board and Audit Committee, as well as senior management, receive reports on an as-needed basis regarding our cybersecurity posture, cybersecurity incidents and remediation efforts.