Lincoln Financial Group 1/22/2024

Lincoln National Corporation 150 N. Radnor-Chester Road Radnor, PA 19087-5221 www.LincolnFinancial.com Lincoln Financial Group is the marketing name for Lincoln National Corporation and its affiliates. Certain affiliates act as the administrative agent for CIGNA Life Insurance Company and Connecticut General Life Insurance Company. LCN-4152324-011122 Page 2 of 2 Continuity Plan Summary Critical Infrastructure and Application Testing LNC’s testing strategy incorporates the use of a Business Impact Analysis (“BIA”) for developing enterprise-wide and Information Technology (“IT”) Disaster Recovery (“DR”) testing strategies. The strategy identifies key roles and responsibilities and establishes the minimum requirements for testing, including baseline requirements for frequency, objectives, and reporting test results. It also drives the requirements for creating and updating Disaster Recovery Plans and Validation Recovery documentation. Testing allows for the evaluation of the level of preparedness that exists in our environment and supports recommendations for resources and funding needed for compliance with applicable federal laws and regulations. Lincoln completes scheduled annual testing focused on pre-defined parts of critical infrastructure. Tests are designed to establish and/or validate recovery time objectives. Additional tests are done periodically to recover individual applications based on criticality. As an example, the scope of the tests may include: • Evaluation of infrastructure (ex: computers, network, hardware) to demonstrate the anticipated operation of the components and system. Tests are often performed as part of normal operations and maintenance. Disaster Recovery tests are often included within these exercises. • Operational readiness testing (“ORT”) is used to conduct operational readiness (pre-release) of a product, service, or system and/or physical infrastructure (ex: building systems, generators, utilities). ORT may include checking the backup/restore facilities, IT disaster recovery procedures, maintenance tasks and periodic check of security vulnerabilities. • Activities performed to evaluate a plan relative to specified objectives or measurement criteria.