GRAPHIC PACKAGING HOLDING CO

The Company has cybersecurity incident response policies and procedures for identifying, assessing and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. The Company's cybersecurity program is based on components of the National Institute of Standards and Technology's Cybersecurity Framework. The Company's Vice President, Information Security, who has 20 years of experience in information security, including nine years as a Chief Information Security Officer, and holds a post-graduate degree in a related field of study and is a Certified Information Systems Security Professional, is primarily responsible for managing cybersecurity risks.

The Company uses a number of other internal and external resources to manage its information technology ("IT") and cybersecurity operations across the Company, including global managed service providers that provide 24/7 support for all of the Company's key IT systems and consultants who are engaged periodically to assist with the Company's evaluation of its systems and processes for preventing and mitigating cybersecurity incidents. The Company's global managed service providers also assess cybersecurity incidents and classify them by severity level in accordance with the Company's Incident Response Plan, which determines how each cybersecurity incident is managed and communicated. The Incident Response Plan also outlines the procedures that the Company then follows for evaluation and recovery from an incident, including containment of the affected systems, in order to restore systems to normal operations. To date, the Company has not had a cybersecurity event that materially impacted its operations, financial position or the security of its proprietary data.

Cybersecurity incidents that are deemed Priority 1 include incidents affecting key operational and financial systems which are reported to certain members of the Company's Executive Leadership Team including the Chief Executive Officer, Chief Financial Officer, General Counsel and Chief Information Officer ("CIO") for assessment of the materiality of the incident, which is made using both quantitative and qualitative analysis to determine an incident's immediate and reasonably likely future impacts. Cybersecurity incidents that are deemed material, either individually or in aggregate, are reported to the Audit Committee of the Company's Board of Directors, which has been delegated the responsibility for oversight of cybersecurity risks. The Company also communicates material cybersecurity incidents to the Company's independent auditors and internal audit team.

Annually, the Company conducts an Enterprise Risk Assessment during which management identifies and quantifies risks to the Company's operations, financial position and strategy, including cybersecurity risks. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee. Working with the CIO and the Vice President, Information Security, the Audit Committee periodically reviews the strategy, priorities, and goals of the cybersecurity program and the CIO and Vice President, Information Security, provide regular updates to the Audit Committee.