CKX LANDS INC

Because of our company’s small size and the nature of our operations, our information technology systems are minimal. The records stored on the company’s systems are primarily non-financial in nature. We have outsourced all of our internal bookkeeping and accounting functions to a third-party accounting firm that maintains all of our financial records on its systems. We rely on the third party’s cybersecurity protections and procedures to safeguard our information, and a consideration of the protections put in place by that firm and any other service provider that receives our information is a critical part of management’s decision to engage the provider.

Our President is responsible for assessing, identifying and managing risks to us from cybersecurity threats. Under his direction, we have contracted with a third-party IT and cybersecurity consultant that monitors our IT systems and firewall protections, as well as those of Matilda Stream Management, which provides offices and administrative services to us.

It is management’s judgment that the processes in place for monitoring cybersecurity risk, including the services provided by the IT consultant, are appropriate given the nature of our systems and our business. We have not encountered cybersecurity incidents or challenges that have materially affected or are reasonably likely to materially affect our company, strategy, results of operations or financial condition.

Our full board of directors is responsible for overseeing and managing risk to our business. Given the extent of our IT systems and the nature of our business, management has determined that it is not currently necessary to make regularly scheduled reports to the board regarding our IT systems and cybersecurity. However, management continually reassesses the most significant risks to our business and would promptly report to the board of directors any material change in the level of risk to our business from cybersecurity threats. Management will continue to consult with our third-party IT firm to monitor this risk and adopt any recommended security protections and best practices.