EVOLUTION PETROLEUM CORP

Cybersecurity risk management is part of the Company’s overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat’s severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size.

Our Board is ultimately responsible for overseeing our risk management, including cybersecurity risk management. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Financial Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to our independent Audit Committee and ultimately to our Board. There were no such cybersecurity incidents or threats that have materially impacted our business or operations. Management presents an assessment of our cybersecurity processes, procedures, and testing results to the Audit Committee at least annually.

Despite our efforts, we cannot eliminate all risks from cybersecurity threats nor provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see discussion captioned “Our business could be negatively affected by security threats. A cyber-attack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation, and/or financial loss.” in Item 1A.Risk Factors.