Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Cybersecurity Program Management

The Company has developed and implemented an information security program (the Cybersecurity Program), which includes various processes and controls intended to protect the confidentiality, integrity and availability of the Company's systems and information. We have also implemented an incident response plan (the IRP) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.

The Company’s Cybersecurity Program and incident response processes were primarily designed and assessed to align with the cybersecurity framework published by the National Institute of Standards and Technology. In addition to our internal cybersecurity capabilities, the Company retains or engages various third-parties in connection with design, implementation and monitoring of certain cybersecurity-related processes and controls.

Key aspects of the Company’s Cybersecurity Program include:

	■	Risk assessments designed to help identify material cybersecurity risks to critical systems and the company-wide information technology environment;
	■	Continuous monitoring of Company systems and conducting periodic penetration tests;
	■	An IRP that includes procedures for responding to cybersecurity incidents;
	■	Required cybersecurity trainings for employees, incident response personnel, and management related to physical security of assets, data privacy and other information security policies and procedures; and
	■	A third-party risk management process for its service providers, suppliers, vendors and other business associates.

The Cybersecurity Program is integrated into the Company’s overall enterprise risk management process and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas. Cyber risks identified in the overall enterprise risk management process are reviewed annually by the Executive Committee.

Risks from Cybersecurity Threat

As of the date of this Annual Report on Form 10-K, the Company has not identified any cybersecurity incidents, including any prior cybersecurity incidents, that have materially affected the Company's operations, business strategy, results of operations and cash flows. The Company faces various ongoing risks from cybersecurity threats that, if realized, are reasonably likely to lead to losses of sensitive information, critical infrastructure or capabilities essential to the Company's operations and could have a material adverse effect on the Company's reputation, financial position, results of operations and cash flows. See "Item 1A. Risk Factors - The Company's business could be materially and adversely affected by security threats, including cybersecurity threats, and other disruptions" for additional information.

Cybersecurity Risk Management Processes Integrated [Text Block]

The Company has developed and implemented an information security program (the Cybersecurity Program), which includes various processes and controls intended to protect the confidentiality, integrity and availability of the Company's systems and information. We have also implemented an incident response plan (the IRP) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

As of the date of this Annual Report on Form 10-K, the Company has not identified any cybersecurity incidents, including any prior cybersecurity incidents, that have materially affected the Company's operations, business strategy, results of operations and cash flows. The Company faces various ongoing risks from cybersecurity threats that, if realized, are reasonably likely to lead to losses of sensitive information, critical infrastructure or capabilities essential to the Company's operations and could have a material adverse effect on the Company's reputation, financial position, results of operations and cash flows. See "Item 1A. Risk Factors - The Company's business could be materially and adversely affected by security threats, including cybersecurity threats, and other disruptions" for additional information.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

The Board is responsible for overseeing the Company’s enterprise risk management processes and has delegated oversight of cybersecurity and other information technology risks to the Executive Committee, a standing committee of the Board. The Executive Committee oversees management’s implementation and execution of the Company’s Cybersecurity Program and IRP. The Executive Committee receives in-depth annual reports from the Director of Information Technology (DIT) or Assistant Director of Information Technology (ADIT)detailing relevant cybersecurity risks to the Company and, as necessary, timely periodic updates based on circumstances, regarding any significant cybersecurity incidents or developments. The Executive Committee reports to the Board regarding its activities, including those related to cybersecurity.

Cybersecurity Risk Role of Management [Text Block]

The Board is responsible for overseeing the Company’s enterprise risk management processes and has delegated oversight of cybersecurity and other information technology risks to the Executive Committee, a standing committee of the Board. The Executive Committee oversees management’s implementation and execution of the Company’s Cybersecurity Program and IRP. The Executive Committee receives in-depth annual reports from the Director of Information Technology (DIT) or Assistant Director of Information Technology (ADIT)detailing relevant cybersecurity risks to the Company and, as necessary, timely periodic updates based on circumstances, regarding any significant cybersecurity incidents or developments. The Executive Committee reports to the Board regarding its activities, including those related to cybersecurity.

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

At the management level, the Company's cybersecurity governance includes a Cybersecurity Steering Committee which is comprised of a subset of the Company's Executive Committee and other key officers, leaders, and subject matter experts from various disciplines across the Company. The Cybersecurity Steering Committee meets quarterly to receive updates from the DIT and/or ADIT on Company-related cyber risks, monitor compliance with the Company's Cyber Security Program, and to review cybersecurity policies.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

The Board is responsible for overseeing the Company’s enterprise risk management processes and has delegated oversight of cybersecurity and other information technology risks to the Executive Committee, a standing committee of the Board. The Executive Committee oversees management’s implementation and execution of the Company’s Cybersecurity Program and IRP. The Executive Committee receives in-depth annual reports from the Director of Information Technology (DIT) or Assistant Director of Information Technology (ADIT)detailing relevant cybersecurity risks to the Company and, as necessary, timely periodic updates based on circumstances, regarding any significant cybersecurity incidents or developments. The Executive Committee reports to the Board regarding its activities, including those related to cybersecurity.

PRIMEENERGY RESOURCES CORP 10-K