Shuttle Pharmaceuticals Holdings, Inc.

Risk Management and Strategy

Together with third-party providers, we have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. Accordingly, the assessment and management of material risks from cybersecurity threats, including any unauthorized occurrence on, or conducted through, information systems that may adversely affects the confidentiality, integrity, or availability of such systems or any information residing therein, are primarily undertaken by such third-parties which are reviewed and monitored by our Interim Chief Executive Officer and our Board of Directors.

Our approach to cybersecurity risk management consists principally of the evaluation and selection of third-party vendors and service providers that we believe maintain appropriate cybersecurity programs and safeguards. We have begun to conduct risk assessments at least annually to identify cybersecurity threats. We rely on these third parties to conduct risk assessments, implement and maintain security measures, and monitor the effectiveness of their controls in addressing cybersecurity risks.

As part of our overall risk management program, we provide cybersecurity training to employees in high risk areas and have distributed standard operating procedures to all employees. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K , including the risk factors entitled*“Failure of our information technology systems could significantly disrupt the operation of our business.*

Governance

One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.

Our Interim Chief Executive Officer is primarily responsible for assessing and managing material risks from cybersecurity threats on a day-to-day basis.