ZION OIL & GAS INC

Risk management and strategy

We assess material risks from cyber security threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our Information Technology (IT) systems that may result in adverse effects on the confidentiality, integrity, or availability of our systems, infrastructure or information residing therein. We have developed and implemented various processes to oversee and manage cybersecurity risks and have integrated this cybersecurity risk management framework into our Company’s broader risk management framework.

Governance

Our management and the Board recognize the critical importance of managing cyber security risks as part of our larger risk management program. While all of our personnel play a part in managing cyber security risks, one of the key functions of our Board is to provide informed oversight of our risk management process, including risks from cyber security threats. Our Chief Financial Officer briefs the executive leadership team, the Board, and the Audit Committee regarding cybersecurity risks, strategy, and management at least annually.

Our cybersecurity team is comprised of members of senior leadership, including in-house legal counsel and independent third-party SOC 2 certified IT and cybersecurity consultants that serve as our Managed Security Service Provider (MSSP). Our MSSP has substantial experience involving cybersecurity risk management and IT, including security, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal executive team on a regular basis.

Engaging Third Parties on Risk Management

We collaborate with vendors, service providers, assessors, auditors, consultants, and otherthird parties on an as-needed basis to develop secure informational and operational technology systems and protect against cybersecurity threats. For example, we engagethird-party security experts to monitor our network and conduct risk assessments and program enhancements.

Managing Third-Party Cybersecurity Risk

We recognize the potential cybersecurity risks associated with the use ofthird parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. These processes include conducting vendor due diligence and risk assessments, participating in industry information sharing groups, subscribing to cybersecurity notification services, and maintaining ongoing collaboration with federal agencies. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties.

Material Impact from Cybersecurity Incidents

The Company has not experienced a material cyber security incident or a cyber security threat that has had, or are likely to have, material impacts to our business, operations, finances, or reputation during 2025 nor in any prior years. The company’s overall risk management systems and processes have followed the recommended guidelines of our cyber security insurance company. The Audit Committee has the board’s oversight of risk from cyber security threats and the responsibility for reviewing the management processes. Management’s role in assessing and managing material risks from cyber security threats is the responsibility of the Chief Financial Officer, who reports and coordinates any potential material risk to the Audit Committee.