GREENWAY TECHNOLOGIES, INC. & SUBSIDIARIES

Cybersecurity Risk Management and Strategy

The Company recognizes the importance of maintaining the security andintegrity of its information systems and data. The Company’s operations are currently limited in scale and are primarily focused on research, development, and administrative activities. As such, the Company’s information technology environment consists primarily of standard, commercially available systems and cloud-based applications used for accounting, communication, and general business operations.

The Company has implemented basic cybersecurity measures designed to protect its information systems and data, including:

The Company does not currently maintain a formal, enterprise-wide cybersecurity risk management program; however, management periodically assesses risks related to cybersecurity and implements measures it believes are appropriate given the Company’s size, operations, and risk profile.

To date, the Company hasnot experienced any material cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, its business strategy, results of operations, or financial condition.

-12-

Cybersecurity Governance

Responsibility for oversight of cybersecurity risk resides with management, primarily the Chief Financial Officer, who oversees the Company’s information systems and related risks. Due to the Company’s limited personnel, cybersecurity responsibilities are not segregated across multiple roles.

Management is responsible for:

The Board of Directors has general oversight responsibility for risk management, including cybersecurity risk. The Board is informed of material risks, including cybersecurity-related matters, through periodic communications with management.

Given the Company’s current size and operations, cybersecurity risk is not managed through a separate committee but is considered as part of the Company’s overall risk management process

Cybersecurity Incident Reporting

The Company has not identified any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company’s business strategy, results of operations, or financial condition.