Summit Hotel Properties, Inc.

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. As part of our approach, we work with third-party cybersecurity and information technology experts, including a managed services provider (“MSP”) that manages and maintains all of our corporate information technology systems (“IT”), and a virtual Chief Information Security Officer (“vCISO”). The vCISO collaborates closely with our internal teams to oversee and enhance our cybersecurity strategy, ensuring alignment with industry best practices such as the National Institute of Standards and Technology (“NIST”) 2.0 framework and regulatory requirements. Our MSP and vCISO work closely under the primary responsibility of our Chief Risk Officer (“CRO”) to review and test our IT environment, and to identify potential risks from cybersecurity threats and proactively mitigate their potential effect; the results of which are regularly presented to management and the Audit Committee of our Board of Directors. Our team of IT experts hold various relevant certifications and have extensive experience in assessing, detecting, responding to and mitigating cybersecurity risks.

Our cybersecurity risk management program is integrated with our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

Key Elements of our cybersecurity risk management program include but are not limited to the following:

•risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information;

•the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents;

•cybersecurity awareness training of employees with access to our IT systems, including incident response personnel and senior management;

•a cybersecurity incident response plan to respond to cybersecurity incidents; and

•a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, consolidated financial position, or consolidated results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, consolidated financial position, or consolidated results of operations. See “Risk Factors – Risks Related to Our Business.”

Cybersecurity Governance

Our Board of Directors (the “Board”) considers cybersecurity risk as critical to the enterprise and manages the cybersecurity risk oversight function through the Audit Committee. The Audit Committee oversees management’s design, implementation and enforcement of our cybersecurity risk management program.

Our CRO regularly reports to the Audit Committee and has primary responsibility for the Company’s overall cybersecurity function working in tandem with our vCISO and MSP, which have extensive expertise in cybersecurity and information technology. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board’s continuing education on topics that may affect public companies.

Our CRO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.