Performance, Board Oversight, and Governance

Data Privacy and Cybersecurity

Our business requires us to process, store, and sometimes share the personal information of our Customers, People, and partners. Our Privacy Program, administered by our Privacy Office, is based on a broad set of privacy principles and applicable law.

To enable data, system, and application security in all areas of our business, Southwest^® has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This is a risk-based approach to mitigate organizational cybersecurity risks and impacts to Southwest's facilities, airports, and aircraft. The NIST CSF helps us understand, manage, and reduce Cybersecurity risk and apply the output of the framework to help inform the Cybersecurity agenda. We also have a dedicated Cybersecurity Team, made up of engineers, analysts, software developers, and Leaders, as part of our Technology Department.

Preparedness, Risk, and Crisis Management

Successful identification and mitigation of risks, along with having appropriate response mechanisms in place to quickly address rapidly emerging events, are essential for our continued viability and success in maintaining a resilient brand for our Customers and Employees. The following Southwest Teams contribute to the Company's risk management and crisis planning efforts:

• Emergency Response is responsible for developing plans, manuals, training, and drills for responses to aircraft accidents, hurricanes, pandemics, campus emergencies, and other disruptive events.
• Business Continuity is responsible for providing a framework that enables Southwest to continue business during disruptions to its Employees, facilities, and technology, while also helping address supplier risks. The Team addresses disruptions by performing business impact analysis and criticality assessments, developing business continuity plans, and managing a dedicated back-up facility.
• Enterprise Risk Management is responsible for overseeing a framework to manage risks that are critical to the overall business goals, objectives, and mission of Southwest Airlines by conducting risk assessments, producing internal reports, defining risk areas, and providing a framework to drive cross-departmental alignment.

We strive to support our communities during times of crisis. Through our Corporate Responsibility efforts, we partner with national and local organizations to support services focused on preparedness, response, building resilience, and living responsibly.

Ethics

The Company seeks to operate with the highest ethical standards and in compliance with applicable laws and regulations. Our Board of Directors has adopted a Code of Ethics that sets out basic tenets to guide the behavior of the Company's Employees, Board Members, and business associates with respect to insider trading; competition and fair dealing; payments to government personnel; confidentiality; conflicts of interest; corporate opportunities; protection and proper use of the Company's assets; recordkeeping; reporting illegal or unethical behavior; and compliance procedures.

Public Policy

Our Governmental Affairs Team works to stay on top of proposed statutory and regulatory changes to educate a wide range of policymakers and Stakeholder groups directly. They also present our views on these topics through trade associations, business forums, chamber organizations, and interactions with public officials at the federal level and in the states and communities we serve. We participate in the trade association Airlines for America (A4A), which allows us to gain insight into core issues for the airline industry as a whole and to advocate jointly for regulations that support a healthy, competitive industry.

We've adopted a policy that we will primarily use our affiliated political action committee, The Southwest Airlines Political Action Committee, financed by contributions made voluntarily by Employees, to support political campaigns. Company funds are limited to supporting selected political campaigns at the state and local level in compliance with the laws of the relevant states and localities. We have a time-tested evaluation process when considering SWAPAC contribution requests, and our criteria for giving are evaluated annually. All contributions by the SWAPAC are disclosed via publicly available reports filed monthly with the Federal Election Commission. We strive to comply with all applicable federal, state, and local campaign finance restrictions and disclosure requirements.