5.5 Scenario analysis The TCFD recommends the use of scenario analysis in order to test the resilience of our business strategy to climate related transition and physical risks. Accordingly, we engaged S&P Global Trucost to assist us 7 with modeling such scenarios using recognized, third-party datasets and climate model outputs. In order to determine the focus of our scenario analysis, we utilized the output of the annual ERM framework to consider climate-related risks in the context of, and relative to, our key enterprise risks. Based on this assessment, and our current residual risks levels, we have focused this analysis on physical risks and the transition risk of carbon p ricing. The results of this analysis will be used to inform our ERM program and risk assessments and we plan to update the scenarios on an ongoing basis for developments in climate science and in our own ability to track and manage climate risks and opportunities. 5.5A Physical risk scenario analysis Physical risk - Scenario selection and assumptions Physical risk could affect our operations both based on the location of our infrastructure, such as our data centers, as well as the location of our employees. Potential Scope Assessment exposure Out of As part of our business continuity and service delivery program, we assess our internal Infrastructure scope infrastructure, including data centers, and their resilience to the physical risk of climate change. At this time, we have concluded that appropriate redundancies are in place at our data centers, or at the public cloud providers we utilize, to ensure resiliency over the short, medium and long term. In Recent events, including the COVID-19 pandemic and wildfires along the west coast of Employees Scope the United States, have demonstrated that the exposure to the physical risks of climate change have the potential to impact our employees, especially as they work from home and as we shift into a w ork from anywhere environment. In order to assess our employee’s exposure to the physical risks of climate change we selected a sample of key Salesforce locations based on our largest office sites by employee number. We then assessed the 8 9 exposure of each location to physical climate risk categories under various climate scenarios and time 10 horizons . 7 These scenarios do not encompass all climate risks or opportunities faced by our company and are intended to be used as a starting point to assess specific climate related risks over various time horizons. These scenarios are subject to significant assumptions and uncertainty. 8 Climate physical risk categories assessed include: Flood, water stress, heatwave, coldwave, hurricanes, sea level rise and wildfire. 9 Climate Scenarios considered: Wherever possible, we utilized the CMIP5 climate model utilized in the IPCC’s 5th Assessment Report with the RCP8.5, RCP4.5 and RCP2.6 pathways representing high, moderate and low scenarios respectively, looking out to both 2030 and to 2050. For hazards where CMIP5 data could not sufficiently model these scenarios, such as water stress, alternative sources like the WRI Aqueduct Water Risk Atlas were utilized. These scenarios are summarized, below: High Climate Change Scenario (RCP 8.5): Continuation of business as usual with emissions at current rates. This scenario is expected to result in warming in excess of 4˚C by 2100. Moderate Climate Change Scenario (RCP 4.5): Strong mitigation actions to reduce emissions to half of current levels by 2080. This scenario is more likely than not to result in warming in excess of 2˚C by 2100. Low Climate Change Scenario (RCP 2.6): Aggressive mitigation actions to halve emissions by 2050. This scenario is likely to result in warming of less than 2˚C by 2100. 10 Time horizons considered include: One year, ten years, and thirty years. 19 | Salesforce TCFD Report