XPO, Inc.

​

■

Expansive Total Rewards: Our total compensation package is instrumental in providing a superior employment experience and conveys how much we appreciate each employee’s choice of XPO. We offer comprehensive health plan options, a pregnancy care policy, family bonding policy, tuition reimbursement and company contributions to 401(k) retirement accounts, as well as virtual preventive health care, virtual physical therapy and diabetes management services at no cost to employees, optional supplemental insurance and short-term loans, and a personalized Total Rewards Statement. In our open enrollment period for 2025 benefit plans, we introduced new options for virtual physical therapy and “physicals on the go,” and enhanced our employee assistance programs specifically for mental health.

​

For additional information about our global organization and culture, see Human Capital Management included in Part I, Item 1 of our 2025 Form 10-K.

BOARD OVERSIGHT OF SUSTAINABILITY MATTERS

Our commitment to advancing sustainability is reflected in our efforts to continually improve our performance on matters that serve the interests of our stakeholders — our stockholders, customers, employees and the communities in which we work and live. Our Board supports these efforts by providing oversight of, and engagement with management, regarding various sustainability initiatives. Since 2020, the Board’s Nominating, Corporate Governance and Sustainability Committee has operated under a charter that describes the Committee’s purpose as, in part, overseeing the work of management regarding the development of sustainability strategies and associated performance and disclosures. The chair and members of the Nominating, Corporate Governance and Sustainability Committee periodically meet with management to discuss sustainability matters, including the preparation and publication of XPO’s externally facing sustainability disclosures.

BOARD OVERSIGHT OF INFORMATION TECHNOLOGY AND CYBERSECURITY RISK MANAGEMENT

Our Board of Directors maintains direct oversight over information technology and cybersecurity risk. Directors receive regular updates from management regarding information technology and cybersecurity governance processes, the status of projects to strengthen internal cybersecurity, and the results of security breach simulations. The Board provides feedback on these matters and also discusses relevant incidents in the industry and the evolving threat landscape. Our Board is also informed of all material cybersecurity incidents — our information security program includes procedures for calling a special session of the Board in the event of a high-risk or critical-risk incident, with measures to provide ongoing updates to senior management and the Board if necessary.

In the event that a cybersecurity incident occurs, our incident response team, composed of members of our information security team and other key personnel, identifies, evaluates and quantifies the relevant risk based on available information, and classifies the severity of the cybersecurity incident based on the level of risk to the company. Our measures are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Board. To date, XPO has not experienced any cybersecurity threats or incidents which have materially affected, or are reasonably likely to materially affect, the company.

Our company has a robust cybersecurity team overseen by our chief information security officer (“CISO”), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat prevention, threat detection, and incident response processes. The cybersecurity team continuously reviews legislative, regulatory, and technical developments related to cybersecurity, and enhances our information security capabilities in order to protect against potential threats. The CISO and information security team provide periodic reports to our chief information officer, Board of Directors, as well as our CEO and other members of our senior management as appropriate. To foster a strong cybersecurity business environment, our CISO meets regularly with his team and key personnel to share information about potential cybersecurity events, monitor, prevent and detect potential cybersecurity incidents, and develop reports for senior management.

As part of our information security program, our CISO and his team integrate our information security measures and evaluation of potential cybersecurity risks into our company’s overall risk management processes.

We are committed to continually improving our detection and recovery processes and have implemented an information security training program that all employees are required to complete at regular intervals. Additionally, our company has obtained an information security risk insurance policy.

For additional information about the Board’s oversight of information technology and cybersecurity risk management, see Cybersecurity included in Part I, Item 1C of our 2025 Form 10-K.

DIRECTOR SELECTION PROCESS

The Nominating, Corporate Governance and Sustainability Committee is responsible for recommending to our Board of Directors all nominees for election to the Board, including nominees for re-election to the Board, after consultation with the chairman and in accordance with our company’s contractual obligations.

Under the terms of the Investment Agreement dated June 13, 2011 (the “Investment Agreement”), by and among Jacobs Private Equity, LLC (“JPE”), the other investors party thereto (collectively with JPE, the “Investors”), and our company, JPE has the right