Company: BSM
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001628280-25-007730
Chunk: 191

Company: Black Stone Minerals, L.P.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 191
---
ITEM 1C. CYBERSECURITY

Cybersecurity threats have become significantly more numerous and sophisticated over time, and the oil and gas industry in particular is highly targeted by malicious actors seeking to attack oil and gas infrastructure to disrupt operations. Because we are focused on mineral and royalty interests, we do not maintain any material physical infrastructure; nonetheless, being an industry participant increases our exposure to external attacks. We are committed to safeguarding our information technology systems and data and managing the risks associated with cybersecurity threats and implemented governance structures, processes, and technologies designed to prevent, detect, investigate, and mitigate any incident that could pose a cybersecurity risk. Our Vice President, Information Technology (“VP IT”), with support from our Information Technology Infrastructure Team (“Infrastructure Team” and, together with the VP IT, the “Cybersecurity Team”), has primary responsibility for the assessment and management of risks from cybersecurity threats. Collectively, the four members of the Cybersecurity Team have over 75 years of cybersecurity-related experience in both the private and public sectors, including perimeter and internal network security, secure email gateway, B2B and B2C eCommerce, on-premises and cloud storage environment security, and ransomware protection solutions. In addition, members of the Cybersecurity Team have multiple network-security certifications relevant to the technologies we deploy. Our Board of Directors provides oversight of our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management on a regular basis and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.Our VP IT, the Director of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.We maintain the following processes to assess, identify, and manage risks from cybersecurity threats:•Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure.•Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We