Mirion Technologies, Inc.

Cyber Risk Management and Strategy

Under the guidance of our Chief Information Officer and Chief Information Security Officer, we have adopted cybersecurity risk management processes that are informed by the ISO 27000 family of standards and take a risk-based approach to improving capabilities, addressing vulnerability, and performing detection and response activities against cyber events.

We have also implemented a process requiring our employees, contractors, and consultants to complete annual cybersecurity training that is designed to raise awareness of cybersecurity threats and risks through training and simulations. Our cybersecurity risk management functions include dedicated teams, tools, and processes focused on the reduction of vulnerability and exposures, risk management, and incident detection, investigation, and remediation. We also have processes to review vendor cybersecurity risk, including inspection of certain vendor certifications.

We also rely on a managed detection and response service provider that helps us manage cybersecurity risks, monitors our environment, and is retained to provide incident response services. We maintain a detailed incident response plan and perform testing of the plan on a quarterly basis. We have also engaged other third-party cybersecurity experts to conduct periodic audits and testing of our processes and systems and maintain cybersecurity insurance.

Governance

The Board has overall oversight responsibility for our risk management, and delegates its oversight of cybersecurity risk assessment and management guidelines to the Audit Committee. The Audit Committee reviews and makes recommendations to management or the Board on matters relating to cybersecurity. Management provides quarterly updates to the Audit Committee and an annual update to the Board. These discussions may include updates on threat focus, roadmaps covering planned improvements, status updates on key improvements efforts, overview information on any recent incidents or significant vulnerabilities (if any), and the status of key information security initiatives. Three of our Board members have received cybersecurity training and certification from the National Association of Corporate Directors (NACD).

Our cybersecurity program is led by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). The CIO is responsible for the management of cybersecurity risks within our environment and key cybersecurity capabilities are developed and operated under the CISO. The CISO holds a Master's degree in Information Security Engineering. Other leaders and contributors on the cybersecurity team have experience in information assurance, digital forensics, network security, and information technology. Several members of the team hold over 15 years of cybersecurity experience and over 20 years of information technology experience, and have various cybersecurity and vendor certifications. The CISO provides regular updates on the cybersecurity program to key executives including the Chief Executive Officer, CIO, Chief Financial Officer, and Chief Legal Officer.

As of this filing, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats to and security incidents relating to information systems. For more information, please see the section entitled “Item 1A. Risk Factors—Risks Related to Our Business Operations.”