Company: OXY-WT
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000797468-25-000029
Chunk: 152

Company: OCCIDENTAL PETROLEUM CORP /DE/
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 152
---
ITEM 1C.    CYBERSECURITY 

RISK MANAGEMENT AND STRATEGY

Occidental has implemented and maintains processes for assessing, identifying and managing material risks from potential unauthorized occurrences on or through its IT and ICS networks that may result in material adverse effects on the confidentiality, integrity and availability of Occidental’s systems and the information residing in those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, written policies, physical safeguards and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting Occidental’s systems and the data it collects, processes, stores and transmits as part of its businesses. Occidental has developed a robust cybersecurity program which is reviewed by senior leadership including its Chief Information Officer (CIO) and other stakeholders as part of its standard general IT controls. Business network and ICS cybersecurity risks are handled by separate and dedicated Occidental teams and are incorporated into Occidental’s enterprise risk management program. Occidental’s cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company’s cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. Occidental has invested in broad cybersecurity awareness and mandatory training to educate those with access to company networks on Occidental’s cybersecurity policies and best practices. Occidental conducts regular phishing tests to educate, train and assess the workforce’s ability to identify malicious emails. The Company also conducts internal security audits and other readiness tests, including audits conducted by third parties and tabletop exercises, to assess and improve preparedness and promote communication and monitoring across the organization. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.  Occidental has implemented and maintains a cybersecurity incident response plan that provides the organizational and operational protocol for the Company to effectively and timely respond to cybersecurity incidents. In the event of a material cybersecurity incident, Occidental’s CIO will receive