Sophos Whistleblowing Policy
Policy Owner

VP, Compliance

Implementation Date

May 2020

Document ID

CC04

Last Reviewed/Update

April 2020

Version #V1.2

AuthorJoanna Watkins, Manager, Corporate
ComplianceApproval

Mark Kinzie

VP Compliance

April 27th 2020

SMT Approval

Rasmi Garde

EVP and Chief Legal
Officer (SMTRepresentative)

April 27th 2020

Version
V1.1
V1.2

Date
June 2015
Jan 2020

Revision History
AuthorApprovalP. Woodward
CFO
J. Watkins
VP Compliance

Summary of Change
Review of Policy
Addition of details
regarding web portal,
hotline, and RBA

REFERENCES
Document ID/Linkwww.sophos.ethicspoint.com
http://www.legislation.gov.uk/eudr/2019/1937
http://www.responsiblebusiness.org/code-of-conduct/

Document Title“Speak Out” Web Page
EU Whistleblowing
Directive
Responsible Business
Alliance Code of Conduct

The Sophos Whistleblowing Policy
Sophos Group Limited and Sophos Holdings, LLC and their respective subsidiaries, (collectively, the“Company” or “Sophos”) embraces and adopts the Sophos Whistleblowing Policy (the “Policy”), which
promotes, encourages, and provides the means for employees, vendors, suppliers, and customers tocome forward with credible information about suspected wrongdoing, illegal conduct, violations ofSophos policies, or violations of Sophos contracts, all for the purpose of creating transparency and aresponsible corporate environment. In doing so, this Policy also provides that the Company willprotect any reporting individual from retaliation.

Policy Objective:
The Company encourages Sophos employees to report suspected wrongdoing as soon as possible. All
reported concerns will be taken seriously, will be tracked individually, and investigated appropriately.
Each concern will be brought to a conclusion. In all instances, the confidentiality of each reporting
individual will be respected.

Background
Whistleblowing is an essential element necessary to foster a work environment of openness,accountability, trust, and productivity. For this reason, whistleblowing is encouraged. Further,whistleblowers often take on high personal risk. Protecting whistleblowers from unfair treatment,
including retaliation, discrimination or disadvantage, emboldens one to report wrongdoing andincreases the likelihood that wrongdoing is reported, uncovered, and brought to an end. For thesereasons, persons in possession of whistleblowing information must report it.
The Company is committed to dealing responsibly and professionally with all genuine concerns. We
expect all Sophos employees to maintain high standards of behavior in accordance with the Sophos
Values. Further, Sophos adheres to the Code of Conduct of the Responsible Business Alliance,
specifically Section D. Ethics (Section 6-Protection of Identity and Non-Retaliation) and Section E.
Management Systems (Section 8-Worker Feedback, Participation, and Grievance) in its administrationof this Policy.

What is Whistleblowing?
Whistleblowing occurs when an individual or individuals (the Whistleblower) pass along information
about wrongdoing. For a matter to be a whistleblowing concern, an individual who makes adisclosure must reasonably believe two things:
1. The first is that the reporting individual reasonably believes that the disclosure shows past, present orlikely future wrongdoing, which properly falls within one or more of the following categories:• Criminal offence• Failure to comply with the law• Endangering one’s health and safety• Damage to the environment• Failure to comply with Sophos corporate policies, including anti-slavery, anti-bribery,
Global Trade Compliance Policy, the use of data, and other policies identified by theCompany• Covering up the wrongdoing in any of the above categories
2. The second is that they are acting in the public interest.
Any other issues which are not covered by the categories above should be reported through theappropriate internal channel (e.g., HR, Compliance, Line Manager).

When to report a concern.
Any person, including Sophos employees, who have information that comprises Whistleblowing
information described in the preceding paragraph (What is Whistleblowing, 1 & 2), must report thatinformation. Sophos encourages participation in the Whistleblowing requirements in the spirit oftransparency and high standards of corporate conduct and Sophos Values. Even so, this Policy is notvoluntary.

How to report a concern.
There are three ways you can report a concern:•In person: you can speak with your line manager about your concerns. They will support you tocomplete the “Open Door Reporting Form” or visit the web portal and support you to raise yourconcern this way.

•Online: Visit the Sophos Speak Out web portal at Sophos.ethicspoint.com and complete the form online.
This alert will be sent to the incident management site where it will be reviewed and allocated for a response
or investigation.

•Call the Hotline: Visit the Sophos Speak Out web portal and enter the country you are located in. This
will provide you with the toll-free number to call. (Each country has its own number, entering thecountry where you are located does not identify you if you wish to remain anonymous).
What happens next?

•Within seven (7) days of the alert being made a response will be sent to acknowledge the receipt ofthe alert. Those making the alert are encouraged to visits the “follow up” pages to check forcommunication, if a person has elected to remain anonymous this will be the only way effective
communication can take place.

•The case will be reviewed and assigned for investigation. The person assigned the case will maintaincontact with the alerter to ensure clear communication about the progress of the case.

•In line with the EU Whistleblowing Directive (section 67) cases are expected to be resolved within 3months ( 6 months for exceptional cases).
We encourage employees to raise whistleblowing matters directly to their line manager, humanresources via the “Speak Out ” reporting page at Sophos.ethicspoint.com.
This policy covers all employees, officers, consultants, contractors, casual workers and agency
workers.

*****