5E Advanced Materials, Inc.

Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

Our cybersecurity risk management program isintegrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

Key elements of our cybersecurity risk management program include but are not limited to the following:

Risk Assessment

We periodically conduct assessments of cybersecurity risks designed to help identify material risks from cybersecurity threats to our critical systems and information.

Cybersecurity Function

Our cybersecurity function is managed by our Chief Financial Officer, who relies on retained third-party cybersecurity consultants to carry out cybersecurity risk assessments, implement and monitor security controls, and coordinate incident response. We do not maintain a dedicated internal cybersecurity staff, which is consistent with our size and operating model.

Protection Measures

We implement and maintain cybersecurity controls, including firewalls, access controls, and intrusion detection systems, to safeguard our systems and data from unauthorized access, use, or disclosure. Furthermore, we use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.

Incident Detection and Response

We have established a cybersecurity incident response plan that includes procedures for responding to relevant cybersecurity incidents. These protocols include incident response plans and escalation procedures to minimize the impact of potential breaches.

Cybersecurity Training and Awareness

All new hires receive cybersecurity awareness training. All employees, including incident response personnel and senior management, receive periodic training and are periodically subject to evaluations to confirm their cybersecurity knowledge and awareness.

Third-Party Risk Management

We have implemented a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile. This process may include review of vendors’ certifications or attestations, review of vendors’ system and organizational controls reports, and contractual requirements relating to data protection and incident notification, calibrated to the sensitivity of the data or systems involved.

Artificial Intelligence Risk Management

We have adopted an AI use policy that governs the use of AI Technologies by our employees and contractors. The policy is designed to address risks associated with AI use, including data privacy, information security, output accuracy, and appropriate human oversight. Our Chief Financial Officer is responsible for oversight of the policy’s implementation, with periodic review to reflect developments in AI Technologies and applicable regulatory guidance.

Material Cybersecurity Incidents

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See “Risk Factors” within this report when evaluating our business and related risk.

Cybersecurity Governance

The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management’s actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company’s cybersecurity, information security, and information technology risks. Periodically, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company’s policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.

Recognizing the importance of cybersecurity to the success and resilience of our business, the Board of Directors considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, our Chief Financial Officer holds discussions on cybersecurity risks and the effectiveness of cybersecurity measures including in response to emerging cybersecurity risks and developments.

Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

Given the size of the Company, we do not employ individuals with significant experience and relevant backgrounds in information security, cyber risk management, and cyber incident response. However, we contract with third-party vendors who have these backgrounds. Our third-party cybersecurity consultants hold relevant professional certifications and have experience in cybersecurity risk management and incident response for companies of similar size and complexity, and our Chief Financial Officer relies on the expertise provided by these third parties in carrying out his cybersecurity responsibilities.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.