NET Power Inc.

We regularly assess cybersecurity risks to our systems, applications, and infrastructure; have established capabilities and corresponding processes to monitor our information systems for potential vulnerabilities and threats; and implement controls pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools and services that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. In addition, we have a dedicated third-party security operations center that performs 24x7 threat monitoring of our systems and environment. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, have the potential to materially affect our operations and, therefore, our results of operations and/or financial condition.

For more information about these risks, refer to the risk factor captioned “Despite implementing and maintaining industry standard security measures and controls, the website, systems, and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales.” in Part I, Item 1A. “Risk Factors.”.

Governance

Our Board oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee oversees our risk management program, which focuses on the most significant risks to our business. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and risks incidents. The Company’s Director of Information Technology is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The Director of Information Technology and his team possess the requisite education, skills, experience, and industry certifications expected of individuals assigned to these duties. The Director of Information Technology provides regular updates on our cybersecurity risk profile to the Audit Committee.