NORFOLK SOUTHERN CORP

Evaluation of Disclosure Controls and Procedures

Our Chief Executive Officer and Chief Financial Officer, with the assistance of management, evaluated the effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (Exchange Act)) at March 31, 2026. Based on such evaluation, our officers have concluded that, at March 31, 2026, our disclosure controls and procedures were effective in alerting them on a timely basis to material information required to be included in our periodic filings under the Exchange Act.

Changes in Internal Control Over Financial Reporting

During the first quarter of 2026, we completed an upgrade of our enterprise resource planning system. As a result, we made changes to certain processes, systems, and related internal controls over financial reporting. These changes include modifications to information technology general controls, automated application controls, and certain business process controls. We believe we maintained appropriate internal control over financial reporting during the implementation. As part of the implementation, we have also designed new internal controls and/or modified existing internal controls as necessary for the new system and business processes. These changes have been and will continue to be subject to our evaluation of the design and operating effectiveness of our internal control over financial reporting.

Other than this system implementation, we have not identified any changes in internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.