Western Midstream Operating, LP

Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our information technology group is led by our Chief Information Officer (“CIO”). Our CIO has over 20 years of information security and project management experience and has previously served as the lead information technology officer to one publicly traded enterprise and the cybersecurity and infrastructure lead at a separate publicly traded enterprise, both in the energy industry. Reporting to our CIO is a Director of Cybersecurity and Infrastructure (“DCI”). Our DCI has over 20 years of information technology and cybersecurity experience and holds a Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium, an internationally recognized association of cybersecurity professionals. This role oversees an enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management, ensuring alignment with our overall information technology and infrastructure objectives. The DCI also leads WES’s Cybersecurity Council, which is a cross-functional internal team, including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the DCI provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES’s cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, as part of our continuing commitment to cybersecurity education and preparedness, we actively engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.

Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see Risk Factors under Part I, Item 1A of this Form 10-K.