SASB Index Accounting Metric Code Boeing Metric or Qualitative Disclosure(s) and Disclosure Location(s) Energy Management Total energy consumed RT-AE-130a.1 Environmental Compliance and Biodiversity, Pages 56-57 ; Key ESG Data, Page 68 CDP climate report Percentage of grid electricity RT-AE-130a.1 Environmental Compliance and Biodiversity, Pages 56-57 ; Key ESG Data, Page 68 Percentage of renewable energy RT-AE-130a.1 Environmental Compliance and Biodiversity, Pages 56-57 ; Key ESG Data, Page 68 Hazardous Waste Management Amount of hazardous waste generated RT-AE-150a.1 Environmental Compliance and Biodiversity, Pages 56-57 ; Key ESG Data, Page 68 Percentage of hazardous waste recycled RT-AE-150a.1 Environmental Compliance and Biodiversity, Pages 56-57 ; Key ESG Data, Page 68 Number and aggregate quantity of reportable spills RT-AE-150a.2 Environmental Compliance and Biodiversity, Pages 56-57 ; Key ESG Data, Page 68 Quantity recovered from reportable spills RT-AE-150a.2 N/A (no reportable spills per SASB application guidance) Data Security Description of approach to identifying and addressing data security risks in company operations RT-AE-230a.2 Boeing takes a risk-based approach to managing the security of its data and has a documented low-risk appetite for cybersecurity and data protection. This approach starts early in the development life cycle and is supported by a partnership between IT and various functions with responsibility for data protection regulations and intellectual property protection. In benchmarking against industry, Boeing has found that its cross-functional approach to data protection is unique and provides a comprehensive view of data security risks throughout the life cycle of information. Data is classified by sensitivity and the protective controls required for each sensitivity level are documented, implemented and audited on a regular basis. Regular reviews of systems are meant to ensure that the appropriate controls are in place and provide opportunities to evaluate risk as change occurs in the operational and cyber environments. If an issue or data security risk is identified, there are clear reporting channels and remediation timelines established based on system and data criticality. Corrective Action Plans are put in place and monitored to completion. Strong partnerships between IT and Boeing Legal ensure that issues are addressed in a timely manner and reporting of incidents to the appropriate regulatory bodies occurs as required. Description of approach to identifying and addressing data security risks in products RT-AE-230a.2 Product Security Engineering provides a disciplined approach to the development and sustainment of our products, which is essential to ensuring mission assurance/resiliency and security. Security is integrated into our engineering processes starting from concept development, ensuring that we develop products that are secure by design. Key cyber attributes and adversity (or threat) to the system are identified during requirements engineering, allocated throughout design, implemented and validated during development, fully tested, and supported during sustainment. Additionally, Boeing works to ensure that our products are designed to anticipate, withstand, recover, and adapt to cyber attack. Specifically, our internal design practices have high-level requirements to baseline and monitor data flow and system behavior, detect anomalies, and actively manage system configuration. The ability of our systems to understand normal operations and rapidly detect and mitigate abnormalities, combined with the security engineering focus of our development processes, provides Boeing’s programs with a proactive approach to risk management. Product Security is also integrated into the Boeing enterprise Incident Response process. We work seamlessly with stakeholders to rapidly identify, analyze and mitigate vulnerabilities and breaches across our portfolio. AR = 2021 Annual Report PR = 2022 Proxy Report 2022 Sustainability Report 82 Contents People Introduction Communities Operations Reporting Approach & Governance Products & Services