MP Materials Corp. / DE

The Company’s information security program is managed by a dedicated Chief Technology Officer (“CTO”), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company’s Cybersecurity Incident Response Committee (the “CIRC”), which is comprised of the Company’s CTO, Chief Financial Officer, General Counsel, Chief Accounting Officer, and Vice President of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.

As part of the Company’s overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company’s internal audit department collaborates with the Company’s information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. Additionally, the Company provides cybersecurity awareness training to its employees, incident response personnel, and senior management.

Furthermore, the Company’s vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software, and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted to mitigate risk.

The Company’s CTO provides periodic reports to the Audit Committee of the Company’s Board of Directors, as well as the CIRC, as appropriate. These periodic reports include updates on the Company’s cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The information security program is regularly evaluated by the CTO with the results of those reviews reported to the CIRC, the Audit Committee of the Company’s Board of Directors, and the Board of Directors, as appropriate.

Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.