About Royal Gold Governance Our People Our Operators and Communities ESG Stewardship Appendices 40 2023 INVESTMENT STEWARDSHIP REPORT ROYAL GOLD Cybersecurity Our Cybersecurity Disclosure Policy and Incident Response Plan are designed to establish acceptable uses of electronic devices, communications systems and network resources and a framework for reporting and managing cybersecurity incidents. Our Board and senior management oversee matters relating to cybersecurity. Under its Charter, the Audit and Finance Committee of our Board is responsible for reviewing the security of our information technology systems and operations, including programs and defenses against cyber threats. The full Board is briefed on cybersecurity at least annually and receives more frequent updates as needed. Our Audit and Finance Committee has direct oversight for cyber risk and receives quarterly updates. Our Senior Vice President and Chief Financial Officer is responsible for cybersecurity matters at the management level. Employees complete cybersecurity training programs semi- annually, or more frequently as warranted by changes to the business operating environment. In 2023, 100% of Royal Gold employees completed cybersecurity training. C YBER RISK SCORE Low Risk High Risk 850 500 650 775 300 763 ISS 5.0.0 Cyber Risk Score As of 05 February 2024 The ISS Cyber Risk Score predicts the likelihood that an organization will suffer a material cybersecurity breach within a 12-month period. “ Our cybersecurity practices at Royal Gold are consistently being evaluated and refined. Annual trainings and various exercises help equip our employees with advanced strategies and tools to protect against evolving cybersecurity threats.” Mike Doerr Royal Gold Vice President, Controller since 2007