DT Midstream, Inc.

Cybersecurity Risk Management and Strategy

To identify, assess and manage the material risks of cybersecurity threats to our business, operations and control environments, we have made investments in our technology and have implemented policies, programs and controls, with a focus on cybersecurity incident prevention and mitigation. Our cybersecurity program is integrated into our risk management process as a distinct risk category of the Company’s enterprise risk management framework and evaluated using the same methodologies applied to other enterprise risks. The program operates under Board-level oversight through the Audit Committee and is managed by a dedicated cybersecurity team that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, and is responsive to emerging threat vectors, including AI-powered attacks. As part of our cybersecurity process, we engage external experts and consultants to assess our cybersecurity program and compliance with applicable practices and standards.

The Company mitigates risks from cybersecurity incidents using a multifaceted approach which includes but is not limited to: establishing information security policies, implementing information protection processes and technologies, assessing cybersecurity risk, implementing cybersecurity training, monitoring our information technology systems, and collaborating with public and private organizations on best practices. This approach includes processes to oversee and identify risks associated with third‑party service providers, including risk‑based due diligence, contractual security obligations, and ongoing vendor oversight. The Company is currently in material compliance with relevant information privacy and cybersecurity governmental standards with which it is required to comply.

The Company has not experienced a material cybersecurity incident during the year ended December 31, 2025. For more information on how material cybersecurity incidents may impact our business, see Part I, Item 1A. "Risk Factors—Risks Relating to Our Business—Other Business Risks—A cyberattack or threat could harm our business" of this Form 10-K.

Cybersecurity Governance

Our Chief Security Officer is responsible for overseeing the Company’s cybersecurity program and has over 20 years of relevant experience in cybersecurity and information security. The cybersecurity team monitors day-to-day risks using the approach described above, and material near-term and long-term risks are communicated with senior management and the Board of Directors. The Company's Board of Directors is engaged in overseeing and reviewing the Company’s strategic direction and objectives, taking into account, among other considerations, the Company’s risk profile and exposures. While the Board of Directors retains oversight over policy and strategy related to cybersecurity, it has delegated the responsibility for the oversight of the Company’s cybersecurity program to the Audit Committee. The Audit Committee is responsible for reviewing and discussing the Company’s policies regarding risk assessment and risk management, major accounting risk exposures and the implementation and effectiveness of risk management protocols with respect to information technology security and cybersecurity risks, as well as reviewing material breaches and attacks, as applicable. Management provides the Audit Committee with regular quarterly updates on cybersecurity risks and mitigations. Material cybersecurity matters would be escalated to the Audit Committee outside the regular quarterly meetings, if any were to occur.