EASTMAN KODAK CO

Risk Management and Strategy

Kodak maintains a cybersecurity program that follows the structure and objectives of the U.S. National Institute of Standards and Technology (“NIST”) Cybersecurity Framework to assess, identify and manage cybersecurity risks. The program is designed to meet multi‑jurisdictional regulatory requirements and incorporates the following key elements:

•

Cross‑Functional Coordination. The IT Security Team, led by the Chief Information Security Officer (“CISO”), is responsible for the implementation and operation of our cybersecurity risk management processes. The team collaborates with the IT Risk Council, the Risk Management and Compliance Committee, Internal Audit, the Chief Privacy Officer, and the Corporate Crisis Management Team to coordinate oversight, monitor, evaluate and review risks and respond to incidents.

•

Ongoing Evaluation of Systems and Controls. We regularly assess our IT systems and infrastructure, implement upgrades to improve performance and security, and monitor for threats. Security controls undergo annual audits, specialized assessments, and reviews such as during our cyber insurance application process.

•

Detection and Prevention Controls. We have implemented appropriate security controls throughout the infrastructure, including endpoints, networks, internet access, and cloud. There is an emphasis on a robust endpoint security implementation given that protects mobile users. Multiple detection technologies are implemented, and monitoring is performed by a 24x7 Managed Detection and Reporting service with top performance ratings in the industry. A comprehensive vulnerability detection and remediation process is in place with security patching on an appropriate schedule. Appropriate penetration testing is performed with at least one annual test performed by an external service provider.

•

Third-Party Risk Management. Prior to sharing data or granting access, all service providers, vendors and partners are assessed relative to their ability and record on compliance, data privacy and IT Security. We use an external service that performs constant security and privacy monitoring and risk rating of companies. Contract terms and conditions protect data privacy and enforce reporting requirements in the event of an incident. Companies with ongoing contracts are re-evaluated periodically.

•

Security Awareness and Training. All employees and other relevant personnel receive mandatory training on IT security, data privacy, policies, and processes. Routine phishing simulations and preparedness exercises supplement this program.

•

Incident Response. We maintain an incident response process with defined roles and escalation protocols. The IT Security Team escalates serious incidents to the Corporate Crisis Management Team. The process includes steps for materiality determination of any impact, and performance of all reporting or other regulatory obligations.

•

Program Review and External Assessments. The IT Security Team, in consultation with senior leadership, updates cybersecurity strategy at least annually to account for changes in business strategy, regulatory developments and the threat environment. Third‑party providers periodically conduct external assessments, with results reported to the Audit and Finance Committee and used to inform program enhancements.

Since the beginning of the last fiscal year, we have not identified any risks from cybersecurity threats or incidents that have materially affected the Company, our business strategy, results of operations or financial condition. For further discussion of potential risks from cybersecurity threats that could be reasonably likely to materially affect us, see “Risk Factors—Risks Related to Kodak’s Business and Operations” in this Form 10-K.

Governance

Management oversees day‑to‑day cybersecurity risk management, while the Board of Directors through the Audit and Finance Committee provides oversight.

•

Board Oversight. The Audit and Finance Committee receive at least annual reports from management, including the Chief Information Officer (“CIO”) and CISO, covering information security, data privacy, trends in cyber threats and the status of security initiatives. A Risk Appetite Statement has been agreed with the Board and it is re-presented once a year. It provides guidance on the budget and guides the security spend to be aligned with the risks as agreed.

•

Management’s Role. The IT Security Team manages cyber risks related to security architecture, identity and access management, and security operations. The team oversees compliance with the cybersecurity framework, reviews policies, benchmarks against standards and manages the security awareness program.

The CISO leads the IT Security Team and reports to the CIO, who reports to the Executive Chairman and Chief Executive Officer. The CISO also reports to the Chief Risk and Compliance Officer to align IT Risk Management with Corporate Risk Management. The CISO has 40 years of IT experience, with over 20 of those focused on IT security functions and strategies, and team members have extensive education and experience. Cybersecurity training is provided upon joining the team, annually and as needed.

The CISO holds monthly IT Risk Council meetings to promote alignment on emerging risks. The IT Security Team and the Council jointly monitor prevention, detection, mitigation and remediation efforts. Significant cyber risks or incidents are reported to the Audit and Finance Committee as appropriate, in addition to the annual cybersecurity update.