NORTH EUROPEAN OIL ROYALTY TRUST

The Trust is a grantor trust, conducts no active operations, has no customers, and maintains no personal or credit data. The Trust’s processes for assessing, identifying, and managing material risks from cybersecurity threats are tailored to its specific circumstances. The Trust’s cybersecurity protocols include, but are not limited to, programs with built-in technological features to prevent disruptions and intrusions, and isolated computer workstations. The Trust’s personnel are aware of the potential of a cybersecurity incident and exercise caution to ensure no such incident occurs. Production downtimes, operational delays, the compromising of confidential or otherwise protected information, destruction or corruption of data, security breaches, theft, other manipulation or improper use of our systems and networks or financial losses from remedial actions could have a material adverse effect on our competitive position, financial condition, reputation or results of operations. The primary entities with which the Trust conducts business are banks, outside service providers, and vendors, which have their own cybersecurity protocols. Interactions between the Trust’s information facilities and outside vendors or service providers involves a combination of passwords, passphrases, and two-factor or independent authorizations.

We have experienced, and could experience in the future, actual or attempted cyber-attacks of our information technology systems or networks. However, there have been no known cybersecurity incidents that have had a material impact, have materially affected or are reasonably likely to materially affect the Trust, including its business strategy, results of operations, or financial condition.

The Managing Director oversees the Trust’s cybersecurity protocols and conducts regular discussions and reviews of such protocols with the Trustees.

• 5 -