Company: REE
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001628280-25-025661
Chunk: 172

Company: REE Automotive Ltd.
Filing Date: 2025-05-15
Form: 20-F
Item: Item 16K
Chunk 172
---
 decision-making, among other responsibilities.

• Least Privilege: REE aims to provide the least access possible to individuals, while allowing them to perform their responsibilities.

• Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents. It also implements controls and procedures through its information security policy to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner, where applicable.

• Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including third-party developed software such as firewalls, intrusion prevention and detection systems, anti-malware functionality, the REE Gateway, and access controls, which are evaluated and improved annually through vulnerability assessments and cybersecurity threat

Table of C ontents

intelligence, as overseen by the Company’s Cyber Security Steering Committee. From time-to-time we conduct network and other tests in combination with technical and management exercises that simulate cyber events.

• Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company’s response to a cybersecurity incident, and such plans are tested and evaluated at least once annually In addition, REE utilizes athird party in order to monitor and respond to incidents.

• Third-Party Risk Management: REE maintains a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company expects its suppliers to comply with security best practices.

• Manufacturing Security: As a manufacturer, REE addresses cybersecurity for its production lines through operational technology security strategies and product security.

• Education and Awareness: The Company provides mandatory training for personnel regarding cybersecurity threats as a means to equip the Company’s personnel with effective tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes and practices.

REE reviews its Information Security Policy at least annually and seeks to update as required. As part of such policy, REE also improves and reviews current REE practices and the REE Information Security Management System (ISMS) to identify improvements based upon changes to the business (e. g., changes to customer demands, regulations, opportunities).

Governance

TheCISO, along with the employees listed below, work collaboratively across the