OPAL Fuels Inc.

Risk Management and Strategy

We rely on information technology and data to operate our business and develop, market, and deliver our products and services to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our confidential, personal, proprietary, and sensitive data (collectively, “Information Assets”). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats. We have implemented an information technology security policy, which includes cybersecurity vulnerability management designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools. We subscribe to reports and services that identify cybersecurity threats, analyze reports of threats and conduct vulnerability assessments to identify vulnerabilities.

Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. We work with third parties, including cybersecurity software providers and managed cybersecurity service providers, to identify and assess cybersecurity risks and conduct penetration testing.

Governance

Our cybersecurity risk assessment and management processes are implemented and maintained by athird-party service provider reporting to the Company's management. Management is also responsible for integrating cybersecurity considerations into our overall risk management strategy, communicating key priorities to employees, approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and making required disclosures. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

Ourboard of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.