Company: MGY
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001698990-25-000006
Chunk: 66

Company: Magnolia Oil & Gas Corp
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 66
---
Item 1C. Cybersecurity

Risk Management and Strategy

The Company has a robust, risk-based cybersecurity program, designed to protect the Company’s data as well as data belonging to its customers and partners. In addition to performing its annual assessment of the overall cybersecurity risk as part of the Company’s Enterprise Risk Assessment evaluation, Magnolia constantly assesses its cybersecurity risks by considering the likelihood of occurrence and the potential impact on the business. The risk identification process considers those common in the oil and gas industry and those that pertain to the technologies within the Company’s applications and infrastructure.Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company’s network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring in an effort to detect and prevent significant cybersecurity threats. Magnolia uses email and spam filtering and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.

29

The Company uses a backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan (“IRP”) in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors, as necessary. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.Cybersecurity risks are an important subset of Magnolia’s overall risk management process. The Company considers the complexity of and reliance on cyber-connected systems in its risk assessment and prioritization. Magnolia’s information security management processes and controls are based upon industry leading frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Through recurring internal audits, controls