Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

GeoPark prioritizes cybersecurity risk management as an integral part of its overall enterprise risk management framework. Our cybersecurity risk management practices provide a structure for identifying, preventing, and responding to cyber threats and incidents while ensuring coordination across all departments.

Since 2022, we have successfully implemented the NIST Cybersecurity Framework and established a 24/7 Security Operations Center (SOC), reinforcing our commitment to cybersecurity and operational resilience. This framework includes:

●

inventory and prioritization of assets connected to GeoPark’s network;

●

implementation and evaluation of controls to protect those assets from cyber threats;

●

inventory and monitoring of critical information through data-loss prevention tools;

●

24/7 monitoring of cyber threats and the status of relevant assets;

●

implementation and testing of processes for mitigating and/or containing cyberattacks;

●

a cyber-incident management process; and

●

a recovery plan to minimize the impact of any cyberattack on the Company’s operations.

Under the NIST framework, we also address potential cybersecurity threats associated with third-party service providers by assessing operational dependencies and embedding cybersecurity requirements within contractual documentation. Third-party providers are required to periodically report on compliance with these requirements.

In 2025, we reinforced our defenses against cyber threats by enhancing our capabilities, adding new roles to the cybersecurity team, implementing continuous measurement and improvement processes, and conducting an independent external assessment of our cybersecurity strategy and framework. We implemented a corporate cybersecurity awareness program for all employees and third parties to strengthen GeoPark’s security culture.

In addition, we optimized our platforms and controls through advanced endpoint detection and response (EDR) and privileged access management (PAM) technologies, based on solutions from Palo Alto Networks and CyberArk, in line with international industry standards for endpoint protection, identity management, and critical access control. We also strengthened our technology infrastructure by adopting network segmentation policies, multifactor authentication, and patch automation, together with a site-recovery plan for critical applications that includes redundant systems in different geographic locations and multi-cloud backups across several service providers.

As part of this evolution, GeoPark adopted the Cybersecurity Capability Maturity Model (C2M2) as a complementary framework to NIST, allowing for a deeper and sector-specific assessment of cybersecurity capabilities within the energy industry and enhancing organizational maturity and resilience against digital threats.

Cybersecurity Risk Management Processes Integrated [Text Block]

GeoPark prioritizes cybersecurity risk management as an integral part of its overall enterprise risk management framework. Our cybersecurity risk management practices provide a structure for identifying, preventing, and responding to cyber threats and incidents while ensuring coordination across all departments.

Since 2022, we have successfully implemented the NIST Cybersecurity Framework and established a 24/7 Security Operations Center (SOC), reinforcing our commitment to cybersecurity and operational resilience. This framework includes:

●

inventory and prioritization of assets connected to GeoPark’s network;

●

implementation and evaluation of controls to protect those assets from cyber threats;

●

inventory and monitoring of critical information through data-loss prevention tools;

●

24/7 monitoring of cyber threats and the status of relevant assets;

●

implementation and testing of processes for mitigating and/or containing cyberattacks;

●

a cyber-incident management process; and

●

a recovery plan to minimize the impact of any cyberattack on the Company’s operations.

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Board of Directors Oversight [Text Block]

Our board of directors has overall oversight responsibility for risk management and delegates cybersecurity risk oversight to the Audit Committee. In this capacity, the Audit Committee reviews and reports to the board on cybersecurity risks and plans to ensure that management has effective processes to identify, assess, and mitigate cyber risks.

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

The IT Director and Cybersecurity and Compliance Manager regularly update the Audit Committee on the Company’s cybersecurity programs, risks, and mitigation strategies.

Cybersecurity Risk Management Positions or Committees Responsible [Flag]

true

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

Our IT Director is a systems engineer with a master’s degree in systems and computing engineering focused on analytics and artificial intelligence, and a master’s degree in business administration. She has more than 16 years of experience in IT roles leading high-impact teams in the adoption of technologies that strengthen organizational strategy and results. Prior to joining GeoPark, she served as Regional Director for Microsoft in Colombia and as Chief Information Officer for Andes University in Colombia.

Our Cybersecurity and Compliance Manager brings over 20 years of experience in cybersecurity, digital transformation, and technology risk management in the oil and gas sector and multinational corporations. He is a systems engineer with a specialization in telecommunications and a master’s degree in project management. He has successfully designed and executed enterprise-wide cybersecurity strategies that protect critical infrastructure and ensure regulatory compliance. He has implemented global cybersecurity frameworks, including NIST and C2M2, strengthening the organization’s security posture and aligning risk management with business objectives. His contributions extend to the World Economic Forum (WEF), where he actively participates in developing global cybersecurity strategies. With deep expertise in governance, risk management, and compliance (GRC), he leads proactive risk mitigation initiatives, fortifying the organization’s defense against emerging threats and fostering a resilient cybersecurity culture across all operational levels.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]

true