CANADIAN PACIFIC KANSAS CITY LTD/CN

CPKC's Item 1C disclosure describes its cybersecurity risk management program (NIST CSF-based, TSA-aligned, third-party penetration testing, vulnerability management) and governance (CIO/CISO reporting to Audit and Finance Committee). The filing states that to date risks arising from cybersecurity threats have not materially affected the Company, its operations, or financial condition. No specific cybersecurity incident is disclosed.