Company: GPOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008043
Chunk: 205

Company: GULFPORT ENERGY CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 205
---
ITEM 1C.CYBERSECURITY

Enterprise Risk Management

Gulfport increasingly relies on digital technology to optimize our business. As our reliance on technology expands, we are exposed to additional cyber-risks, which we focus on assessing, identifying, and managing. These risks include, but are not limited to: financial risks, operational risks, safety concerns, employee and owner personal information and violation of data privacy or security laws.

36

Table of ContentsIndex to Financial Statements

Managing Material Risks & Integrated Overall Risk ManagementWe take an integrated approach to assessing and identifying cybersecurity risks and threats. At the corporate level, cybersecurity is identified as a key risk within our Enterprise Risk Management (ERM) program. Our management of cyber risk is based on the National Institute of Standards and Technology’s (NIST) cybersecurity framework. While the NIST cybersecurity framework is our foundation, we combine that with the Center for Internet Security’s (CIS) control framework. We utilize a defense-in-depth approach, layering security starting with cloud-based tools through our perimeter all the way to the client and server end points with End Point Detection and Response solutions. We continue to invest and align advances in technology to strengthen our security posture. This year we implemented tools that provide additional visibility into lateral movement, enhancements for multifactor authentication, and patching of servers. Cyber risks and incidents are categorized by severity, evaluated for materiality, responded to based on defined incident response playbooks and then remediated accordingly. We perform organized tabletop exercises to test these practices and identify areas where opportunities for improvement can occur. We acknowledge that—even with advanced security tools—we are only as strong as the people that use our technology. That is why we design phishing simulations and require multiple security trainings for every employee annually. Our partnerships with law enforcement, the Oil and Natural Gas Information Sharing Center and our third party partners continually mature our cyber program as threats evolve.Engaging Third Parties on Risk ManagementRecognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assess and mitigate cybersecurity threats to us. For example, in addition to our security analysts, we partner with third parties that provide 24/7 security operations monitoring, enhancing our response time. We are also audited by third parties for compliance with information security standards and assess vulnerabilities annually, providing additional expertise that strengthens our security posture.Managing Third Party RiskWe also recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have