Allegion

Risk Management and Strategy

Allegion plc recognizes the significance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and products and protect the confidentiality, integrity and availability of our data.

Managing Material Risks & Integrated Overall Risk Management

Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Chief Information Security Officer (“CISO”) leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our risk management group works with our cybersecurity team to continuously evaluate and address cybersecurity risks.

All employees are required to comply with our information security policies and are responsible for helping protect our information security, including promptly reporting suspected security events through established channels. We maintain an employee security awareness program and a security training program for technical personnel that provide mandatory and on‑demand training. As part of these programs, every employee is expected to report any suspected security event immediately upon discovery. Employees may report incidents through established channels such as the security operations mailbox, our ticketing portal or service desk, or by contacting local IT support.

Engage Third Parties on Risk Management

We engage a range of external experts, including cybersecurity consultants and auditors to evaluate and test our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. Our cybersecurity programs generally align with the NIST Cybersecurity Framework 2.0, and third-party audits on portions of our cybersecurity program or processes apply the NIST Cybersecurity Framework 2.0 controls. These partnerships provide expert knowledge and insights, which are designed to ensure our cybersecurity strategies and processes are consistent with industry best practices.

Oversee Third-party Risk

We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented processes designed to manage the cybersecurity risks associated with its use of third-party service providers.

Risks from Cybersecurity Threats

Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems; result in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; and/or jeopardize the security of our facilities. The adoption of AI by threat actors has resulted in more sophisticated and scalable attacks. These may include AI‑enabled social engineering, deepfake impersonation, automated vulnerability discovery and exploitation of AI models themselves. The use of AI by our stakeholders, including vendors and customers, may also introduce new vulnerabilities into our ecosystem. These risks are further described in the risk factors within Item 1A, particularly under the headings “We may be subject to risks relating to systems failures or disruptions to our information technology and operational technology systems;” “We currently rely on third-party service providers for many of the critical elements of our global information and operational technology infrastructure, and their failure to provide effective support for such infrastructure could increase our cybersecurity risk or otherwise negatively impact our business and financial results;” and “Disruptions or breaches of our information systems could adversely affect us.”

We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

Governance

The Board of Directors (the "Board") has established oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats.

Board of Directors Oversight

Due to the importance of cybersecurity to the Company, the full Board is charged with oversight responsibility for our risk management and security strategy and policy. The Board is composed of members with diverse expertise including, risk management, information technology, engineering, manufacturing, innovation and finance, equipping them to oversee cybersecurity risks effectively. The Board receives updates from the CISO and management at least quarterly at board meetings, which updates cover the Company's cybersecurity strategy, current cybersecurity risk assessment, key risk areas, current cyber trends and any significant cyber incidents that have occurred or are reasonably likely to occur.

Management’s Role

Management is responsible for assessing and managing cybersecurity risk. Specifically, the CISO is responsible for the prevention, mitigation, detection and remediation of cybersecurity incidents. The CISO regularly meets with the Chief Executive Officer (“CEO”) and Executive Leadership Team to inform them on cybersecurity risks. These briefings encompass a broad range of topics, including:

•Threat intelligence;

•Risk updates with regional vice presidents;

•Third-party assessments and results of tabletop exercises;

•Training programs for employees;

•Results of phishing simulations;

•Cybersecurity technologies and best practices; and

•Significant cybersecurity incidents and/or trends (if any).

Risk Management Personnel

Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 20 years of experience in the field of information technology, the CISO brings a wealth of expertise to the role. The CISO’s education includes a Master’s in Cybersecurity Management. The CISO has in-depth knowledge and experience in developing and executing our cybersecurity strategies. The CISO oversees our governance programs, tests our compliance with standards, remediates known risks and leads our comprehensive employee security awareness program. The CISO is also responsible for building and overseeing a cybersecurity team, including internal and external resources, who provide subject matter expertise and operational talents to achieve our cybersecurity objectives.

Monitor Cybersecurity Incidents

The CISO and the cybersecurity team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is an important component in designing programs to prevent, detect, mitigate and remediate cybersecurity incidents. This includes monitoring emerging AI-driven threats and adapting our detection, prevention and response capabilities to address them. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and informing the board of significant cyber incidents in accordance with the Company’s incident response plan.