Brookfield Oaktree Holdings, LLC

Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree’s overall enterprise risk management processes and is focused on protecting the Company’s corporate information technology environment and related information assets.

The underlying controls of the cyber risk management program are designed to meet Oaktree’s business requirements, risk profile, and operational requirements. The program leverages elements of recognized industry frameworks, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”). Oaktree conducts annual security testing through an internal audit of its cyber risk management program and an independent third-party penetration test of its systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and ongoing monitoring of third-party vendors that are considered to be high risk. Although these controls and processes are designed to mitigate risks, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside our control.

A Managed Security Service Provider (MSSP) operates Oaktree’s Security Operations Center, providing 24/7 monitoring of the Company’s global systems and responds to initial security alerts. Alerts are escalated to Oaktree’s Cybersecurity team for investigation, response and remediation, as appropriate. Oaktree engages third-party service providers and utilizes external technologies to support the performance and effectiveness of its cybersecurity program and to supplement internal capabilities.

Oaktree’s Chief Information Security Officer leads Oaktree’s cybersecurity team and reports to Oaktree’s Chief Technology Officer. The Chief Information Security Officer is responsible for overseeing Oaktree’s cyber risk management program, including assessing and managing cybersecurity risks, and informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity team has significant experience in information technology, cybersecurity, operations, governance, risk management, and compliance, and leverages threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.

The Chief Information Security Officer has over 25 years of experience in information technology and cybersecurity leadership, specializing in areas such as cybersecurity, IT governance, controls, compliance, network engineering and cloud computing.

The audit committee of the board of directors oversees the cybersecurity risk management program. The cybersecurity team provides periodic updates to the audit committee regarding Oaktree’s cybersecurity posture, key risks, and the effectiveness of the cybersecurity program. Oaktree’s Internal Audit team also reports the results of its annual cybersecurity audits to the audit committee.

Oaktree faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. Oaktree has experienced, and expects to continue to experience, cyber incidents in the ordinary course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, Oaktree’s business, business strategy, financial condition, results of operations, or cash flows. See “Risk Factors – Risks Relating to Our Business – Oaktree’s failure to maintain the security of its information and technology networks, including personal data and client information, intellectual property and proprietary business information could have a material adverse effect on us.”