Company: REE
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001628280-25-025661
Chunk: 171

Company: REE Automotive Ltd.
Filing Date: 2025-05-15
Form: 20-F
Item: Item 16K
Chunk 171
---
Item 16K. Cybersecurity

REE recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners (such as suppliers, vendors or other external parties) and employees. REE’s cybersecurity policies, standards, processes and practices are fully integrated into our risk management program and are based on recognized frameworks established by the Israel National Cyber Directorate, ISO 27001, ISO 21434 and other applicable industry standards.

Risk Management and Strategy

As part of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:

•Identifying and Managing Risks:

◦ Ongoing risk assessments, including through the use of a third party, to identify internal and external threats and vulnerabilities on an on-going basis and to classify each into risk categories. Escalation is conducted based upon the assigned risk profile, including escalation by the third party to REE’s Chief Information Security Officer, or CISO. Additionally, we undertake risk classifications with respect to our suppliers/vendors by identifying the information that such entity will access, collect and/or process and identify the potential threats and risks that may exist as a result. Based upon such classifications, we consider the information security and privacy requirements for the contract with such entity. Access to REE data, and specifically personal data by external parties, may be based upon a contract and an appropriate preliminary risk assessment process. Certain contracts contain specifications with respect to security procedures and the ability to conduct testing and/or site visits.

◦ The Company also uses third parties to conduct penetration tests from time-to-time with respect to its information technology and for operational technology (production) and products.

◦ With respect to certain contracts involving personal data, we attempt to outline which data will be collected, how it will be processed, and who may access such data, among other items. We also may seek to include provisions relating to confidentiality and information security, and the implementation of appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated therein. Where practicable, we consider notification provisions to notify REE upon the occurrence of a cyber attack that affects REE in any way, and/or as otherwise required under applicable law.

• Management:REE’s CISOis responsible for developing, maintaining and overseeing the REE security program, providing oversight, direction, and advice to the organization regarding information security, assist and coordinate with respect to security incidents (as applicable), assess REE’s security risks and communicate them to REE’s leadership team as a basis for risk-based