CONSTELLIUM SE

Process

We have established a cybersecurity risk management process that aims to identify, assess, mitigate, monitor, and report

on the IT risks and cybersecurity threats that may affect our business objectives, performance, reputation, and compliance. We

conduct an overall annual cybersecurity risk assessment to identify and prioritize the IT and IT security risks that may impact

our business strategy, results of operations, and financial condition. We have processes and controls that help prevent, detect,

and recover from security incidents and we also perform regular security assessments to test the resilience of our IT systems

and networks against potential attacks and vulnerabilities. Our employees are provided awareness training on a regular basis to

help them identify, avoid, mitigate, and report cybersecurity threats.

We use security assessments, penetration testing, and table-top or red teaming exercises with third parties to assess our

security posture and to improve our processes on a continuous basis. We also use our Internal Audit function to conduct

additional reviews and assessments. Our third-party service providers are subject to security risk assessments at the time of

onboarding, on a continuous basis and upon detection of an increase in risk profile. In addition, we require our providers to

meet appropriate security requirements, controls and responsibilities and to investigate security incidents that have impacted

such providers, as appropriate.

Management

Our Chief Information Officer/Chief Digital Officer (“CIO/CDO”), together with the Company’s security team, is

responsible for assessing, monitoring, and managing our cybersecurity risks. Our CIO/CDO has significant experience in IT

security, information security, and cybersecurity, with nearly two decades of experience andhaving served in a variety of senior

roles at the Company (and others) prior to serving as CIO/CDO. Our CIO/CDO also has experience with implementing various

security and infrastructure transformation and improvement programs.

The Company has an Enterprise Risk Management (“ERM”) Committee and process in place that reviews and evaluates

the overall risks to the Company, including its cybersecurity risks. The ERM process has the input of senior management and

other internal stakeholders, and the cybersecurity risk management process is integrated into our ERM review. Cybersecurity

risks to the Company are reviewed, evaluated, and discussed on a quarterly basis and, when necessary, on an ad-hoc basis with

our Executive Committee and other members of the management team.

We maintain controls and procedures that are designed to promote prompt review and escalation of certain cybersecurity

incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner to

comply with cybersecurity incident reporting requirements.

Board of Directors

Our Board of Directors, through its Audit Committee, oversees the management of the Company’s cybersecurity

program and risks from cybersecurity threats. Our Audit Committee receives annual reports on cybersecurity risks resulting

from risk assessments, progress of risk reduction initiatives, external auditor feedback, internal audit reports on IT, IT security

and cybersecurity-related topics, control maturity assessments, and relevant internal and industry cybersecurity incidents. The

CIO/CDO also informs the Audit Committee on the prevention, detection, mitigation, and remediation of cybersecurity

incidents, including significant security risks and information security vulnerabilities. The Audit committee reports any

significant matters to the Board of Directors.

Risks

We rely on our IT systems to effectively manage and operate our business, including such processes as data collection,

accounting, financial reporting, communications, supply chain, order entry and fulfillment, other business processes, and in

operating our equipment. A cybersecurity incident could disrupt our business and could result in transaction errors, processing

inefficiencies, limited equipment utilization, the loss of sales, customers, or intellectual property, causing our business and

financial results to suffer. Although such risks have not materially affected our business, financial conditions, results of

operations or reputation to date, we have, from time-to-time experienced cybersecurity incidents in the normal course of

business. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors".