Trilogy Metals Inc

The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These areintegrated into our overall risk management systems, as overseen by our Board and delegated to the Audit Committee. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

The Company uses a multi-layered, multi-vendor cybersecurity protection structure that focuses on user security and system and infrastructure security to mitigate cybersecurity threats such as unauthorized access, cybersecurity attacks and other security incidents. These and other potential security threats may damage or disrupt our hardware and software systems, lead to a loss of data or to the misappropriation of confidential information. To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior including, but not limited to: the use of antivirus software, restrictions on installing applications directly to users’ machines, the deployment of internet browsing filters, remote access using a VPN client, multi-factor authentication, network firewalls and email protection.

Governance

Management is responsible for managing cybersecurity risks and bringing to the Board’s attention any material risks. Under the oversight of the Audit Committee, the Company’s Chief Financial Officer is primarily responsible for the assessment and management of cybersecurity risks andutilizes a third-party consultant to assist with managing these risks.