Intercontinental Exchange, Inc.

Our business activities rely extensively on technology and software, including the systems used by our business partners, regulators and customers. In addition, our activities involve the use and retention of confidential data and information. These activities make us susceptible to cyberattacks. We employ the following activities, processes and strategies to help evaluate, manage and address these risks.

•Strategy: We maintain a Cybersecurity Strategy, or CSS, which emphasizes consideration of the nature of our business, ongoing intelligence collection regarding cybersecurity threats, and initiatives to specifically address prominent areas of cybersecurity risk. The CSS outlines the key priorities for our cybersecurity program and the methods by which our Information Security department seeks to accomplish those goals.

•Governance and Leadership: Our Board of Directors is responsible for overseeing our risk management process, which includes management of general risks as well as specific risks, such as those relating to cybersecurity, facing our business. The Risk Committee of our Board of Directors has been delegated the primary responsibility for overseeing management’s identification and mitigation of cybersecurity risk. The Risk Committee is composed of board members with diverse expertise including cybersecurity, risk management, technology, business operations, regulatory and finance. The Risk Committee receives presentations on at least a quarterly basis from our Chief Information Security Officer, or CISO, and senior members of the Enterprise Risk Management, or ERM, team, and the Chair of the Risk Committee provides reports to the full Board of Directors following such presentations. Our Information Security department is led by our CISO, who, in addition to quarterly presentations to the Risk Committee of our Board of Directors, also provides comprehensive reports to a dedicated internal governance committee at least quarterly outlining threat assessment, control performance, and ongoing enhancements. Our current CISO has served in the role since September 2021 and leads the cybersecurity program across our regulated futures and options exchanges, CCPs, trade repositories, equities venues, systemically important financial market utilities (SIFMUs) and our data services network and mortgage technology platforms. Prior to joining ICE, our CISO served as CISO of the White House Military Office and as CISO for two technology companies, and has more than 20 years of experience in cybersecurity, national security, and intelligence. Additionally, cybersecurity matters are reported to and discussed with a cross-subsidiary leadership committee and subsidiary boards. The Cyber Threat Intelligence team monitors multiple cybersecurity intelligence sources and curates the applicable data. In the event we identify a cybersecurity threat applicable to us, we have a process to evaluate, escalate to Senior Management and respond to the threat faced. In addition, our CISO and other senior security leaders conduct periodic cybersecurity education sessions with our employees and directors. These sessions cover general cybersecurity topics as well as specific details regarding our cybersecurity program.

•Risk Management: Cybersecurity risk management is integrated into our broader ERM framework. Our cybersecurity leadership team, in concert with our ERM team, assesses threats and risks at least annually through the Enterprise Technology Risk Assessment process, which includes threat objective inherent risk score determination, identification of key and supporting controls, and resulting residual threat objective risk scores. Additionally, thematic threats such as sabotage, fraud, and theft of assets or customer data are used to frame our risk management activities. Asset theft often involves organized crime or financially motivated nations staging sophisticated, well-planned campaigns to steal significant cash, cryptocurrency, or equivalent assets. Our thematic threats, along with others, are evaluated by our Board of Directors as well as our Risk Committee, Corporate Risk Officer and our CISO. The CSS provides the framework we use for assessing risk, prioritizing testing, identifying remedial actions and validating improvements. The CSS also provides for the deployment of external and internal teams of ethical hackers that operate alongside our traditional vulnerability detection processes.

•Information Sharing: We recognize the importance of collaboration and information sharing among private sector firms in the financial services sector, across sectors, and with global public-sector agencies, when appropriate. Our cybersecurity leaders hold memberships and/or positions within the Financial Services Information Sharing and Analysis Center, or FS-ISAC, and the cross-sector Analysis and Resiliency Center, or ARC, in the U.S., the Financial Sector Cyber Collaboration Centre, or FSCCC, in the U.K., and similar organizations across the Europe, Middle East and Africa, or EMEA, and Asia-Pacific, or APAC regions.

•Third-Party Risk Oversight: We maintain a third-party risk management program. Our Information Security team provides subject matter expertise to our vendor management team to help assess a vendors' cybersecurity processes. Vendors are assessed before we engage them, and once engaged, are monitored periodically to ensure that they maintain compliance with our cybersecurity standards.

•Independent Security Attestation: We utilize both internal assessments and assessments by third parties, including external security assessors, consultants and auditors, to evaluate and test our cybersecurity program. ICE’s Internal Audit, ERM, and Information Security Assurance teams conduct frequent assessments of varying scope to validate that our cybersecurity program controls and remediation processes are operating effectively. External auditors are contracted to perform annual Service Organization Controls, or SOC, report attestations of both business and security controls. In addition, our Cybersecurity Incident Response Plan is tested at least annually. Our internal "Red Team" conducts multiple tests each year driven by key cybersecurity risks. The results of these reviews alongside frequent regulatory and customer examinations are assessed, with any resulting mitigation activity assigned and tracked to remediation.

•Controls: Our identification of risks and selection of cyber-related controls is performed in the context of the critical financial infrastructure we maintain and operate. Our ongoing threat assessments are intended to identify changes in external events and in our activities, infrastructure and processes that could necessitate reprioritization of risks and controls. The nature of our business activities mandates an emphasis on sabotage and asset theft as primary threats in addition to contemporary themes of data theft. Our focus on these threats leads to an emphasis on network security, social engineering controls, behavioral detection of insider threat, and deliberate and rehearsed recovery strategies.

Although we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity threats, we have been, and expect to continue to be, subject to cyberattacks, hacking and other cybersecurity risks. For further information on our cybersecurity risks, see Part I, Item 1(A), "Risk Factors", including the risk factor entitled “Our systems and those of our third-party service providers are vulnerable to cyberattacks, hacking and other cybersecurity risks, which could result in wrongful manipulation, disclosure, destruction, or use of our information or that of a third party, or which could make our customers unable or reluctant to use our electronic platforms,” included elsewhere in this Annual Report.