WEST FRASER TIMBER CO., LTD

Cyber Security

Our information and operations technology systems, including process control systems, are subject to heightened cyber security risks and are vulnerable to natural disasters, fires, power outages, vandalism, attacks by hackers or others or breaches due to employee error or other disruptions. While we have information and cyber security programs in place, the measures, controls and technology on which West Fraser relies may not be adequate due to the increasing volumes, sophistication and rapidly evolving nature of cyber threats. We have had in the past, and may in the future, experience cyber security incidents. Any such incident, attack on or breach of our systems including through exposure to potential computer viruses or malware could compromise our systems and stored information may be accessed, publicly disclosed, lost or compromised, which could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruptions to our operations, decreased performance and production, increased costs, and damage to our reputation, which could have a material adverse effect on our business, financial condition and results of operations. As cyber security threats continue to evolve, we may be required to expend additional resources to continue to modify or enhance protective measures or to investigate and remediate any security vulnerabilities. Our exposure to these risks cannot be fully mitigated due to the nature of these threats. Our inability to adequately address risks from cyber security attacks could result in significant disruption to our information technology infrastructure and business applications, stoppage to our major operating, sales and financial processes and harm to our reputation and relationships with our customers and suppliers. Further, disruptions resulting from cyber security breaches could expose us to potential liability or other proceedings by affected individuals, business partners and/or regulators. As a result, we could face increased costs as a result of cyber security incidents for which we do not have insurance coverage.

In order to mitigate against the impact of potential cyber security breaches, we will be reliant on our disaster recovery and business continuity plans in order to continue our business operations with minimal disruption in the event of a cyber security breach. The success of these disaster recovery and business continuity plans will be contingent upon our ability to design and maintain effective plans that are resilient and will enable us to protect our information technology systems and data without disruption to our business. Our inability to design and maintain effective recovery systems may adversely impact our ability to manage a cyber security breach without disruption to our operations with the result that our reputation may be harmed, we may be subject to regulatory reporting risk, our relationships with our customers and suppliers may be harmed and our result of operations may be adversely impacted.

• 48 -

In addition to risks we face from cyber security incidents directed at our systems, we also face risks from cyber security incidents impacting third parties, including but not limited to contractors, customers, consultants and suppliers, directly or indirectly involved in our business and operations. We are vulnerable to damage and interruptions from incidents involving these third parties, and may be exposed to consequences that could have a material adverse effect on our financial condition, operations, production, sales and business.