Company: EXEEZ
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000895126-25-000021
Chunk: 235

Company: EXPAND ENERGY Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 235
---
, regarding any significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk 

50

TABLE OF CONTENTS

management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director’s continuing education on topics that impact public companies.Our Cybersecurity Manager leads our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats and reporting significant incidents to our Cybersecurity Committee, which includes our Chief Financial Officer, General Counsel and Corporate Secretary, Chief Information Officer, Cybersecurity Manager and Director of Internal Audit. Our Cybersecurity Manager has over 20 years of experience in information security and incident response and our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations. Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, such as external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.