UNRESOLVED STAFF COMMENTS
+Added: Index to Financial Statements
CYBERSECURITY
1 unchanged sentence
As a Company that manages midstream infrastructure for the energy sector, cybersecurity is of great concern to our organization, and we aim to protect our systems, networks and programs from digital attacks.
−Removed: We have endeavored to implement policies, standards, and technical controls based on external cybersecurity standards, such as National Institute of Standards and Technology (“NIST”) and ISO frameworks.
+Added: We have endeavored to implement policies, standards, and technical controls based on external cybersecurity standards, such as National Institute of Standards and Technology (“NIST”) framework and ISO standards.
Like others in our industry, we are reliant on the continuous and uninterrupted operation of our various technology systems.
3 unchanged sentences
We use various processes and tools, including third-party cybersecurity tools and technologies, to aid us in seeking to secure and protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption, including those processes described below.
−Removed: Kinetik has an established risk management policy supported by underlying processes to execute and meet the Company’s risk management objectives.
−Removed: This Policy is based on the NIST requirements.
+Added: Cybersecurity is integrated into our risk management framework and the Company has established IT policies supported by underlying processes to execute and meet the Company’s risk management objectives.
Risk Assessment:
5 unchanged sentences
Monitoring and detection systems have been implemented to help identify and remediate cybersecurity threats.
−Removed: All potential security events and/or confirmed security incidents, as appropriate, are reported and logged in to the Company’s authorized incident management systems.
+Added: All potential security events and/or confirmed security incidents, as appropriate, are reported and logged into the Company’s authorized incident management systems.
The Company’s incident response team (“IRT”), along with the third-party security system providers, aims to review, analyze, categorize and take action on reported security events.
11 unchanged sentences
At Kinetik, we believe that the recognition and reporting of cybersecurity threats by every employee and contractor plays a key role in protecting and securing our network.
−Removed: We have mandatory annual training for our employees and contractors on
−Removed: Index to Financial Statements
−Removed: security awareness annually, using a library of cybersecurity training modules.
−Removed: We deploy quarterly simulated phishing emails to all system users in an effort to gauge their cybersecurity awareness.
+Added: We conduct mandatory annual training for our employees and contractors on security awareness, using a library of cybersecurity training modules.
+Added: We also deploy quarterly simulated phishing emails to all system users in an effort to gauge their cybersecurity awareness.
Access Controls:
Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions.
−Removed: To keep our network secure, we have multifactor authentication (MFA) for all users, a password change policy, separation of duties in accounting systems, controlled access to network drives, endpoint protection, email security, mobile device management, device encryption, and ongoing active monitoring of threats.
+Added: To keep our network secure, we have multifactor authentication (MFA)
+Added: Index to Financial Statements
+Added: for all users, a password change policy, separation of duties in accounting systems, controlled access to network drives, endpoint protection, email security, mobile device management, device encryption, and ongoing active monitoring of threats.
We have implemented devices designed to control third-party access to our plant systems and also provide 24/7 monitoring of our infrastructure.
5 unchanged sentences
The Board’s Oversight and Management’s Role
−Removed: Our Board has delegated the responsibility for overseeing cybersecurity risk.
+Added: Our Board has delegated the responsibility for overseeing cybersecurity risk to our Audit Committee.
Our Audit Committee oversees management’s assessment and management of cybersecurity risk.
7 unchanged sentences
The Cybersecurity Dashboard also includes commentaries on risk exposure and materiality, if any, as they relate to cybersecurity.
−Removed: Our executive team, in particular, our Senior IT Director and members of our IRT, have relevant degrees in computer information systems and extensive experience and background in network design and configuration, endpoint protection, privileged identity management, device encryption, cloud network and infrastructure, cloud email security, security information and event management (SIEM), and vulnerability assessments.
−Removed: This combined expertise is important to our cybersecurity risk management processes.
+Added: Our Senior IT Director brings more than 16 years of specialized experience in the oil and gas industry, with deep expertise in infrastructure and cybersecurity.
+Added: He has over eight years of proven IT leadership, where he has successfully spearheaded major digital transformation programs, accelerated cloud adoption strategies, elevated cybersecurity maturity, and managed complex, large-scale system implementations and integrations.
+Added: He holds a Bachelor of Science in Computer Information Systems from the University of Houston.
+Added: Our dedicated IT team is responsible for ensuring compliance with relevant cybersecurity standards, establishing robust protocols, and safeguarding the integrity, confidentiality, and availability of the organization's IT infrastructure.
+Added: Collectively, the team possesses over 40 years of IT experience, including more than 20 years focused specifically on cybersecurity.
+Added: The IT team is also responsible for ensuring the entire Kinetik workforce receives annual training to stay on top of cybersecurity risks facing our industry today.
As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
1 unchanged sentence
Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur.
−Removed: See “Risk Factors” in Part I—Item 1A of this Annual
+Added: See “Risk Factors” in Part I—Item 1A of this Annual Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.
Index to Financial Statements
−Removed: Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.
LEGAL PROCEEDINGS
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.