Hess Midstream LP

The Company’s business and proprietary information, information technology (“IT”) and operational technology (“OT”) networks are essential to our success. Chevron provides substantial operational and administrative services to us in support of our assets and operations, including processes for the assessment, identification and management of material risks from cybersecurity threats. The Company utilizes Chevron’s cybersecurity program, which is designed to protect our information assets and operations from external and internal cyber threats by identifying and appropriately managing and mitigating risks while ensuring business resiliency. This program isintegrated within the Company’s Enterprise Risk Management (“ERM”) process, which is our systematic approach to identifying, managing and assessing major risks and safeguards, including cybersecurity risks. Chevron’s cybersecurity program uses a risk-based information security process aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.

Chevron’s worldwide team of cybersecurity professionals undertakes a range of preemptive activities to protect its people, assets and reputation globally, including those of the Company. Chevron also leverages internal and external resources to monitor cybersecurity threats to our systems and networks and to understand the broader threat environment. The Company seeks to remove exploitable weaknesses in systems or devices before they become a threat, leveraging Chevron’s resources. The Company leverages Chevron’s security experts that use automated threat intelligence feeds to increase vulnerability awareness, taking action to mitigate the highest risks. Chevron’s cybersecurity guardrails, which are high-level design requirements expected to be built into any new digital solutions being deployed, are also updated on an ongoing basis to align with changes in industry standards and the evolving threat environment, which are utilized by the Company.

The Company’s cyber risk management process includes testing and risk assessments of technologies, third-party suppliers, and its IT and OT networks. These assessments ensure that our focus is on the highest priorities to maintain the security of our assets. To further protect our systems and data, Chevron’s cybersecurity organization has threat intelligence capabilities to monitor security breaches impacting third-party suppliers. Asthird-party risks increase, the approach tothird-party supplier risk management and qualification continues to evolve, including the ongoing expansion of its current supplier risk management program beyond IT vendors to other high-risk, third-party vendors.

Chevron’s Chief Information Officer (“CIO”) oversees Chevron’s broader IT program, which includes the cybersecurity program utilized by the Company and the Company’s ability to remediate and recover from a cybersecurity incident to minimize business and operational impacts. Chevron’s CIO joined Chevron in 2024, bringing more than 20 years of experience leading global innovation initiatives in digital, data, full supply chains, vehicle commerce, energy, and IT operations for technology and automotive companies. Chevron’s Chief Information Security Officer (“CISO”) reports to the CIO and leads a global cybersecurity team that provides services to the Company. Chevron’s CISO has 20 years of cybersecurity experience and is responsible for providing a single and consolidated view of Chevron’s enterprise cybersecurity risk. Before joining Chevron, he held senior leadership roles, including that of CISO, at other multinational, publicly traded companies.

Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. The cybersecurity organization provides Chevron’s IT leadership, which includes Chevron’s CIO, with regular cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on the Company’s networks and third-party supplier networks. The leadership of the cybersecurity organization has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents applicable to the Company are provided to our senior management and our audit committee of the Board, as appropriate.

Chevron’s dedicated cyber risk organization meets regularly with us to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the enterprise. The Company, in coordination with Chevron, has invested in broad cybersecurity awareness and required training to educate those with access to our networks on our policies and best practices. The Company, in coordination with Chevron, conducts regular phishing tests to train and assess our workforce’s ability to identify malicious emails.

The Company’s Corporate Audit Department has a dedicated team responsible for IT and information security (including cybersecurity) audits. In coordination with Chevron, the Company also leverages external resources to reinforce its cybersecurity capabilities. On a regular basis, external consultants provide a maturity assessment of Chevron’s cybersecurity program, utilized by the Company.

Chevron’s approach to managing risks, including cybersecurity risks, is embedded within Chevron’s Operational Excellence (“OE”) Management System (“OEMS”). The OEMS provides a systematic process that enables Chevron to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron’s and our business, including cybersecurity. The Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify the Company’s critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. In coordination with Chevron’s cross-functional teams, the Company also conducts regular multidisciplinary exercises to test and improve response plans.

Our general partner’s board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee primary responsibility for oversight of the Company’s risk management practices, including oversight of cybersecurity and other information technology risks. The audit committee of our general partner’s board of directors provides oversight of our cybersecurity program, receives reports from management on cybersecurity risks in connection with our operations and projects, and also reviews cybersecurity risks as part of the Company’s broader annual ERM process. The audit committee receives presentations on cybersecurity topics from management at least twice a year. In addition, management updates the audit committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition; however, the Company has experienced and will continue to experience cyber incidents of varying degrees. Despite the cybersecurity measures that the Company is taking to mitigate such risks, there can be no guarantee that such measures will be sufficient to protect the Company’s systems, information, intellectual property and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on the Company or its results of operations or financial condition or cause reputational or other harm to the Company. Refer to Item 1A. Risk Factorsfor further discussion of cyberattacks and the associated risks to the Company’s business.