MACH NATURAL RESOURCES LP

Mach’s cybersecurity posture is proactive and multifaceted, reflecting our prioritization of safeguarding our organization against cyber threats. Through the implementation of advanced technologies and adherence to rigorous standards, we have developed a robust multilayered defense strategy designed to protect our data and information systems and align with industry best practices.

Risk Management and Strategy

Our approach to cybersecurity is comprehensive, and includes continuous risk management strategies to safeguard our digital assets and ensure the integrity and confidentiality of our data.

We employ a strategic combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the International Organization for Standardization (ISO), and the Center for Internet Security (CIS) best practice standards to benchmark and enhance our cybersecurity measures. We believe this multifaceted approach allows us to maintain a robust security posture, manage risks, and respond to evolving cyber threats.

Our cybersecurity practices include:

-Data Monitoring and Loss Prevention: We continuously scan and monitor our systems to detect and prevent data breaches, in an effort to ensure sensitive information remains secure.

-Network Vulnerability Testing: Regular assessments of our network’s security through certified third-party testers to identify and remediate vulnerabilities.

• Robust Encryption: Implement strong encryption protocols to protect data in transit and at rest, mitigating the risk of unauthorized access.

• Continuous Monitoring: We are monitoring our digital environment continuously to detect and respond to potential security incidents quickly.

• Regular Updates: Systematic updates to our security systems in response to new threats and vulnerabilities, in an effort to maintain effective defenses.

In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We obtain Systems and Organization Controls (“SOC”) 1 and SOC 2 reports, as applicable, from our third-party service providers which assess those entities’ controls to cover security, availability, integrity, confidentiality and privacy. Any applicable findings of this third-party assessment are analyzed by the appropriate employees and further action is taken as needed.

Management

Cybersecurity is a paramount enterprise risk, demanding vigilant attention and strategic planning. Our Chief Information Officer (“CIO”), with over 20 years of technological and leadership experience in the oil and gas industry, is responsible for all aspects of the Company’s information technology, including cybersecurity, networking, infrastructure, applications, data management and protection. The Cybersecurity Team led by the CIO, assesses and manages cybersecurity threats, implements the comprehensive cybersecurity risk management program, and supervises both the internal IT staff and external cybersecurity consultants.

The Cybersecurity Team serves a crucial role in reporting significant incidents to the CIO. The Cybersecurity Team, along with our CIO, convenes at least once each week to review any incidents related to digital security and the corresponding response actions, analyze emerging threats to the organization’s cybersecurity landscape, and deliberate on and discuss preventative strategies. Our Cybersecurity Team receives cybersecurity news and updates from various private energy sector and federal security working groups and organizations.

Governance

Cybersecurity risks are managed alongside the Company’s other enterprise risks, which the Board of Directors oversees. The Company’s IT security efforts, encompassing cybersecurity, fall under the oversight of the Audit Committee of the Board of Directors. The Company’s cybersecurity strategy undergoes a quarterly review by the Audit Committee. During these sessions, the CIO provides a comprehensive update to the Audit Committee on cybersecurity and data protection matters. This includes an assessment of the Company’s actions to recognize and reduce cybersecurity risks. Furthermore, the Company adheres to established procedures for reporting significant cybersecurity events to the Audit Committee or the Board, as appropriate.

To date, the Company has not experienced any material cybersecurity incidents, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results or financial condition. Please see “Risk Factors” in Item 1A in this Annual Report on Form 10-K for further discussion regarding the Company’s cybersecurity risks.