Serve Robotics Inc. /DE/

Cybersecurity Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to robots, employees or customers; violation of privacy or security laws and other litigation, legal and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

Our cybersecurity risk management program is integrated with our overall enterprise risk management program. As part of these processes, and to ensure confidentiality, integrity and availability of critical data and systems, we have implemented various technologies that aid in the prevention, detection, investigation, response and remediation of vulnerabilities, cybersecurity incidents and risks. These technologies and processes include, but are not limited to, mobile device management, virtual private network security services, attack surface management services, cloud threat detection and response systems, cloud security posture management solutions, cloud-native security scanners and source code analysis tooling, continuous compliance monitoring, phishing simulation, and security awareness training solutions.

Evaluation and mitigation ofthird-party risks are included within our overall risk assessment process. We perform due diligence on third parties with access to our facilities, networks, systems, organization or client data to include third-party service providers who act as sub-processors assisting in the delivery and support of our services. Where necessary, we require third parties that could introduce significant cybersecurity risk, to agree by contract to employ technical, administrative and physical security safeguards and to agree to be subject to cybersecurity audits, which we conduct as appropriate. See the risk factor entitled “We are subject to cybersecurity risks to our robot fleet, operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors...” in Part I, Item 1A. “Risk Factors” in this report for more information.

Our security team is led by our VP of Security who has over 15 years of direct cybersecurity experience, including incident response, security operations and management. The VP of Security oversees our security and infrastructure teams, which are responsible for the continuous monitoring, reporting and response to threats and vulnerabilities discovered through the deployment and operation of these tools. As part of our risk management strategy, our cybersecurity team conducts routine vulnerability and risk assessments within our product operations and service environments. Our VP of Security oversees these assessments and ensures the results of these reviews and any incidents identified by security tooling are reported to senior management and the internal steering committee as part of the quarterly reporting process. As part of routine security assessments, if any material deficiencies relating to IT general controls over financial reporting are discovered, the VP of Security is required to report them directly to the executive management team and internal steering committee without delay.

In the last three fiscal years, we have not experienced, and are not aware of, any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For additional information about these risks, see Part I, Item 1A.“Risk Factors.” We have not incurred any penalties or entered into any settlements related to cybersecurity matters.

Cybersecurity Governance

Our internal steering committee and board of directors oversees our risk management strategies and processes, regarding risk assessment and risk management as they relate to cybersecurity. Our security and infrastructure teams are responsible for implementing and maintaining cybersecurity and data protection controls and practices for the protection of our robots, customer and company information, systems and data. The VP of Security in coordination with our internal steering committee, whose members include professionals from our executive team, general counsel, product and technology and finance teams, meet quarterly to review our Cybersecurity risk exposure, discuss internal and external threat actors and prioritize remediation strategies. The internal steering committee makes decisions on the avoidance, transference, acceptance and mitigation of our overall cybersecurity risk exposure.

Our steering committee, typically in joint session with the full board of directors, meets quarterly with the Company’s executive leadership to receive reports regarding our overall security posture. These reports include updates on the implementation of cybersecurity controls, data security, risk assessments, the status of internal cybersecurity projects, technology compliance, employee awareness training and any notable incidents that have occurred within the quarter and related remediation efforts.