LSB INDUSTRIES, INC.

We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platforms, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations, the risks associated with cybersecurity also increase.

We utilize an enterprise-wide risk management process to identify, assess, track and manage risks faced by our organization. The Company’s Enterprise Risk Management Committee (the “ERM Committee”), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber, technology, and third-party risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting processes and tools. Our team uses widely adopted methods and models to identify, evaluate, prioritize, and manage cyber and technology risks and develop and implement related information security safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other business resilience exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with industry-recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical safeguards and address a wide range of current cyber threats, including from third-party service providers. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.

Governance

Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management’s cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber and operational risk. This ERM Committee is composed of each of the Company’s Executive Vice Presidents and each of the Company’s Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology (“IT”) leads the information security program, manages cyber governance and incident management.

The Vice President for IT and the Director of Infrastructure and Cybersecurity have over 45 years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reportsto the Board on critical cyber risk and security topics presented to the Audit Committee by management. In addition, informal and ad hoc conversations about cyber risk and industry developments frequently occur among Board members and management.

Incident Management

We have implemented security procedures and measures in order to protect our information from theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cybersecurity incidents. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board. During 2025, we did not experience a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we make extensive efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers’ systems that could adversely affect our business. For a discussion of these risks, see “Item 1A. Risk Factors—General Risk Factors.”