MACH NATURAL RESOURCES LP

Mach's cybersecurity posture is proactive and multifaceted, reflecting our prioritization of protecting our organization against cyber threats. Through the implementation of advanced technologies and adherence to rigorous standards, we have established a layered defense strategy to protect our information and computer systems and align with industry best practices.

Risk Management and Strategy

Our approach to cybersecurity is comprehensive, and includes continuous risk management strategies to safeguard our digital assets and ensure the integrity and confidentiality of our data.

We employ a strategic combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the International Organization for Standardization (ISO), and the Center for Internet Security (CIS) best practice standards to benchmark and enhance our cybersecurity measures. This multifaceted approach allows us to maintain a robust security posture, manage risks, and respond to evolving cyber threats.

Our cybersecurity practices include:

Data Monitoring and Loss Prevention: We continuously scan and monitor our systems to detect and prevent data breaches, ensuring sensitive information remains secure.

• Network Vulnerability Testing: Regular assessments of our network's security through certified third-party testers to identify and remediate vulnerabilities.

• Robust Encryption: Implement strong encryption protocols to protect data in transit and at rest, mitigating the risk of unauthorized access.

• Continuous Monitoring: We are monitoring our digital environment continually to detect and respond to potential security incidents quickly.

• Regular Updates: Systematic updates to our security systems in response to new threats and vulnerabilities, ensuring our defenses remain effective.

Management

Cybersecurity is a paramount enterprise risk, demanding vigilant attention and strategic planning. Our Chief Information Officer, with over 20 years of technological and leadership experience in the oil and gas industry, oversees all aspects of information technology, including cybersecurity, networking, infrastructure, applications, data management and protection. The Cybersecurity Team led by the CIO, assesses and manages cybersecurity threats, oversees the comprehensive cybersecurity risk management program, and supervises both the internal IT staff and external cybersecurity consultants.

The Cybersecurity Team serves a crucial role in reporting significant incidents to the Chief Information Officer. The Cybersecurity Team, along with our Chief Information Officer, convenes at least once a week to review any incidents related to digital security and the corresponding response actions, analyze emerging threats to the organization's cybersecurity landscape, and deliberate on and discuss preventative strategies. Our internal cybersecurity team receives cybersecurity news and updates from various private energy sector and federal security working groups and organizations.

Governance

Cybersecurity risks are managed alongside the Company’s other enterprise risks, which the Board of Directors oversees. The Company's IT security efforts, encompassing cybersecurity, fall under the oversight of the Audit Committee within the Board of Directors. The Company's cybersecurity strategy undergoes a quarterly review by the Audit Committee. During these sessions, the Chief Information Officer (CIO) provides a comprehensive update to the committee on cybersecurity and data protection matters. This includes an assessment of the Company's actions to recognize and reduce cybersecurity risks. Furthermore, the Company adheres to established procedures for reporting significant cybersecurity events to the Audit Committee or the Board, as appropriate.

To date, the company has not experienced any material cybersecurity incidents, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results or financial condition. Please see “Risk Factors” in Item 1A in this Annual Report on Form 10-K for further discussion regarding the Company’s cybersecurity risks.