Company: REE
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001628280-25-025661
Chunk: 173

Company: REE Automotive Ltd.
Filing Date: 2025-05-15
Form: 20-F
Item: Item 16K
Chunk 173
---
 Company to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company’s incident response and recovery plans. Such program includes the Cyber Security Steering Committee, REE’s management, and, if necessary, the Disclosure Committee with respect to disclosure considerations. To facilitate the success of the Company’s information security policy, the CISO and his team regularly monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time, and report such threats and incidents to the Risk Management Committee when appropriate.

• CISO: Responsible for developing, maintaining and overseeing the REE security program; providing oversight and direction and advising the Company regarding information and physical security; assisting and coordinating during security incidents; assessing REE’s security risks and communicating them with REE’s leadership team as a basis for risk-based decision-making

• Global IT Manager: Responsible for developing, maintaining and overseeing the REE network; providing and revoking access; recertification of user access to all systems on a regular basis; managing employees workstations/laptops including configurations, installations and upgrades, and ongoing maintenance; managing company information assets according to best practices and regulatory requirements; overseeing implementation of new systems to the organization (SaaS, hardware, etc.); and granting and/or revoking access to systems according to employee onboarding and off-boarding processes.

• General Counsel: Acts as REE’s Data Protection Officer; provides advice regarding data protection regulation requirements and employee contracts; manages REE Data Protection Agreements for customers and vendors; and handles non-disclosure agreements, employee contracts and asset contracts.

• Government, Risk and Compliance Manager, or GRC: Responsible for managing REE’s Information Management Program; designing and implementing data protection methodologies and guidelines; verifying alignment with global data protection laws such as the GDPR; and testing the effectiveness of technical and administrative security controls.

• DevOps Engineer: Responsible for building new development tools and infrastructure with regards to cybersecurity.

Table of C ontents

REE’s CISO is experienced in the field of cybersecurity, including having served as the head of the Cybersecurity Guidance department of the Israel National Cyber Directorate from 2019 to 2021, among other cybersecurity roles over the past 20 years, including as a cybersecurity consultant to several high tech companies in Israel. Additionally, from 2018 to 2019, our CISO led and managed the cyber studies at INT College (NESS) in Israel.

As of the date of this annual report, cybersecurity threats,