PAR PACIFIC HOLDINGS, INC. 10-K

Item 1B. UNRESOLVED STAFF COMMENTS None. Item 1C. CYBERSECURITY We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our customers, against cybersecurity threats that could have material adverse effects on the integrity and effectiveness of our information systems. The Information Technology (“IT”) committee of our Board of Directors, together with the Audit committee, oversees the Company’s enterprise risk management process, including the management of risks arising from cybersecurity threats. The IT committee typically reviews the measures implemented by the Company to identify and mitigate cybersecurity risks on a quarterly basis. As part of such reviews, the IT committee receives reports and presentations from the Company’s Chief Information Officer (CIO) that address a wide range of topics, including recent developments, evolving standards, oversight of third-party vendors, and technological trends related to cybersecurity. The full Board of Directors often attends these presentations . At the management level, our cybersecurity strategy is managed by the CIO. The CIO’s extensive experience in technology and risk management, including prior work experience at organizations of similar complexity, complemented by other members of our IT department and third-party vendors, form the backbone of our cybersecurity capability. Our cybersecurity program is based on recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology Cybersecurity Framework. Cybersecurity incidents that meet established reporting thresholds are escalated within the Company to the CIO and the Company’s executive leadership team and, where appropriate, reported to the IT committee and Board of Directors. Cybersecurity threats and related incidents have not had a material impact on the company to date, but future cybersecurity incidents could have a material effect on our business, financial condition, and results of operations. Moreover, cybersecurity insurance may not be available on commercially reasonable terms. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful attacks. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. — Risk Factors.