Clearwater Paper Corp

Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board of Directors, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process’s annual risk assessment is presented to the Board of Directors.

Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board of Directors. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

During 2024, we did not experience any cybersecurity threats that had a material impact or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. Please see our "Risk Factors" in item 1A in this report for more information.