Product security is a top priority at Lenovo,
reflecting our commitment to providing
products that meet or exceed industry
standards for security. We accomplish thisthrough Security by Design, an industry term
descriptive of our approach that puts security
at the heart of everything we do from thestart and through a robust series of security
reviews across the product lifecycle.

SECURITY BUILT IN THROUGHOUT
PRODUCT LIFECYCLE
Lenovo’s Product Security Program drives security fromthe start of product development and across the productlifecycle. Security is a crucial part of:Development
Security requirements are part of the initial productdesign and are followed through the development ofour products. Software is tested and approved by ourSoftware Security Review Board (SSRB) before being
incorporated into our products.
Manufacturing
Lenovo’s global manufacturing system leverages a
mix of both company-owned assets as well as original
design manufacturers (ODM) partners. Our global
manufacturing footprint spans the U.S., Japan, Mexico,India, Brazil, Germany, Hungary and China – with 11 of37 manufacturing plants being in-house facilities. Thisis not only a source of competitive advantage, butalso provides greater efficiency and control over bothproduct development and supply chain operations.

Security Leadership

Supply Chain
Lenovo evaluates suppliers of intelligent components
to validate that each supplier understands and follows
proper security practices. We do this through ourTrusted Supplier Program, which ensures suppliers takeownership of the security of their products by providing
auditable security assurance to our customers. Lenovo’s
supply chain has been recognized by Gartner as being
one of the Top 7 High Tech supply chains since 2015,and by Chain Security as “likely ahead of the industry” interms of security.
First- and Third-Party Testing
Lenovo products – particularly data center products –periodically undergo third-party security assessments
conducted by U.S. Government-approved testers toprovide deeper validation for new products or address
specific customer requests.

1

INDUSTRY LEADING INCIDENTRESPONSE PROGRAM
Virtually all IT products from any vendor are susceptible
to problems caused by the constantly changing
security landscape. The United States’ NIST National
Vulnerability Database (NVD) and routine DHS US/CERT
advisories, for example, reflect this. The key measuresof a world class product security program are how avendor responds to security issues, provides fixes, andproactively manages cybersecurity risks, all things that
Lenovo does not just effectively, but also transparently.
Lenovo’s Product Security Incident Response Team(PSIRT) provides timely evaluation of potential
vulnerabilities and, when pertinent, prompts fixes tomitigate these vulnerabilities. Lenovo has clear processes
for customers and third-party researchers to reportpotential vulnerabilities and is transparent in reporting
associated fixes. Lenovo’s security teams are staffed byrecognized industry experts.

DATA SECURITY AND PRIVACY
We recognize that security is about more than justsoftware protections, and that some customers haveunique security needs. This is why communication
between our products sold to government andenterprise customers and Lenovo servers is maintained
within the specific continent or country designatedby the customer. And whether a large company or anindividual customer, each customer’s data privacy isprotected, as detailed in our Lenovo Privacy Statement.

TRANSPARENT, GLOBAL BUSINESSFounded in China in 1984 Lenovo is a Fortune Global
500 company employing 57,000 people aroundthe world and doing business in 180 markets. Ourgrowth has been fueled organically as well as throughacquisitions, integrating business operations and staff
from units of IBM, Medion, NEC, Motorola and Fujitsu.
Revenue is equally balanced across the company’s
four geographic business regions: the Americas, Asia
Pacific, China and EMEA (Europe Middle East andAfrica) – making Lenovo a truly global company.
Lenovo is headquartered in Hong Kong and is listed on
the Hong Kong Stock Exchange, with approximately
65% of the company’s stock owned by the public andwith depositary receipts on other public exchanges
such as the NYSE. We are open, transparent andaccountable to our public shareholders as well as toa wide range of other stakeholders globally. Lenovo’s
independent board of directors has a global reachhailing from four different countries and the senior
management team includes five nationalities amongits 15 members. Lenovo is truly independent and is
not controlled by the government of China, the UnitedStates, or any other country in which it operates. We
are proud to count numerous government agencies
and their respective departments as our customers
around the world.
More information about Lenovo’s structure, ownershipand financial performance is available in the company’s
annual report.

TRUSTED, VERIFIED SUPPLIERKEY FACTS

Our focus on quality and security is why Lenovo has
been a trusted supplier to commercial customers
globally since 2005. In fact, in 2019, more than 300 of
the world’s Fortune 500 companies bought Lenovo
technology products. Lenovo is also a trusted supplier tolocal and national government entities around the world,with a years-long track record of strong partnership.
Significantly, Lenovo has undergone five comprehensive
and thorough reviews by the U.S. Government’s
Committee on Foreign Investment in the United States(CFIUS), and has won approval all five times to acquiresignificant U.S. businesses including the PC and Serverbusinesses from IBM, and the Motorola phone businessfrom Google. Lenovo’s repeated success with the CFIUS
process reflects the strength of our governance – as does
our continued satisfactory completion of routine annual
CFIUS compliance audits.

•Founded in 1984•

Publicly listed on the Hong Kong Stock
Exchange in 1994

•Acquires IBM Personal Computing Divisionin 2005 to become world’s 3rd largest PCcompany•Acquires IBM x86 Server business in 2014

•Acquires Motorola in 2014•

Lenovo is now the #1 PC provider on theplanet, with 1 in every 4 PCs purchased
today a Lenovo product•Currently employs 57,000 people worldwide
doing business in over 180 markets

Security Leadership2

RECOGNIZED INDUSTRY EXPERTSDoug Fisher
Lenovo’s Chief Security Officer, Fisher has worldwide
responsibility and oversight for the integrity of Lenovo’s
supply chain, products, services and solutions, and dataprotection.
Daryl Cromer
Vice President and head of product security for Lenovo’s
PCSD. Cromer is a prolific inventor with over 370
patents, Cromer leads Lenovo’s research teams for PCs,
smartphones and other smart devices, including theincorporation of Artificial Intelligence in the expanding
Internet of Things.
Anthony Corkell
Vice President and head of product security for Lenovo’s
Data Center Group. Corkell has more than 20 years’experience driving quality improvements in Lenovo’sproducts.
Bill Jaeger
Executive Director of Lenovo’s Data Center Group
Product Security Office, leading a comprehensive
program to align the security product offerings withenterprise customer needs. Jaeger has a 25+ year recordof achieving positive outcomes in guiding organizations
through business-critical security and technicalchallenges. He is a member of the Black Hat security
conference guest review board and a frequent speaker atsecurity conferences and briefings.

Security LeadershipPaul Stapleton
Executive Director of Lenovo’s PC & Smart DevicesProduct Security Office leading global productand application security for this division as well as
global efforts to secure Lenovo’s Cloud Platforms
and Services. Stapleton has been building andleading security programs at national and globalorganizations for more than 20 years. He has
extensive experience in all domains of cyber security.
Richard Rushing
Motorola’s Chief Information Security Officer is a
global cybersecurity expert named by CISO Platform
as one of the “Top 100 Security Influencers.”
Jason Ruger
Lenovo’s Chief Information Security Officer is anexpert in cyber, cloud and mobile security with morethan 20 years of cybersecurity and IT leadershipexperience at Lenovo, Google, Motorola, Apple andSymantec.
David Rivera
Principal Engineer and Director of Software andDevice Security for Lenovo’s Global Security Lab,Rivera has more than 25 years of experience in PC
software design and development and security, andis responsible for ensuring application designs andimplementations are secure. He also specializes in
PC authentication technologies and has served as
Chair of the FIDO Alliance Certification Working
Group since its inception.

3