CSX Corporation: 10-K Risk Factor Changes

The Company relies on information technology in all aspects of its business. The security, stability and availability of the Company’s and its key third-party vendors’ information technology systems are critical to its ability to operate safely and effectively and to compete within the transportation industry. A successful data breach, cyber-attack, or the occurrence of any similar incident that impacts the Company’s or its key third-party vendors’ information technology systems could result in a service interruption, train accident, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties. A disruption or compromise of the Company’s or its key third-party vendors' information technology systems, even for short periods of time, and any resulting theft or compromise of Company confidential or proprietary information (including personal information), could adversely affect the Company’s business or reputation, create significant legal, regulatory or financial exposure and have a material adverse impact on CSX’s business, financial condition or operations. CSX 2023 Form 10-K p.8 CSX 2023 Form 10-K p.8 CSX 2023 Form 10-K p.8 CSX 2023 Form 10-K p.8 CSX 2023 Form 10-K p.8 CSX 2023 Form 10-K p.8

The Company relies on information technology in all aspects of its business. The security, stability and availability of the Company’s and its key third-party vendors’ technology systems are critical to its ability to operate safely and effectively and to compete within the transportation industry. A successful data breach, cyber-attack, or the occurrence of any similar incident that impacts the Company’s or its key third-party vendors’ information technology systems could result in a service interruption, train accident, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties. A disruption or compromise of the Company’s information technology systems, even for short periods of time, and any resulting theft or compromise of Company confidential or proprietary information (including personal information), could adversely affect the Company’s business or reputation, create significant legal, regulatory or financial exposure and have a material adverse impact on CSX’s business, financial condition or operations. CSX 2022 Form 10-K p.8 CSX 2022 Form 10-K p.8 CSX 2022 Form 10-K p.8 CSX 2022 Form 10-K p.8 CSX 2022 Form 10-K p.8 CSX 2022 Form 10-K p.8

PART I The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents. These incidents may include, among other things, malware, ransomware, distributed denial of service attacks, social engineering, phishing, theft, malfeasance or improper access by employees or third-party vendors, software bugs, server malfunctions, software or hardware failures, human error, fraud, or other modes of attack or disruption. Attacks of these nature are increasing in frequency, levels of persistence, intensity and sophistication, including by nation-state threat actors or those associated with nation-states. Further, the Company may be at increased risk of experiencing a cyber-attack as a result of being a component of the critical U.S. infrastructure. If such an event takes place, the Company may be required to incur significant expenses in excess of existing cybersecurity insurance coverage. As cybersecurity threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities, data breaches, cyber-attacks or other similar incidents. The Company or its third-party vendors may also experience cybersecurity incidents as a result of employees, third-party vendors and other third parties with which they interact working remotely on less secure systems and environments. Despite the Company’s efforts to protect its information technology systems, it may not be able to prevent or anticipate all data breaches, cyber-attacks or other similar incidents, detect or react to such incidents in a timely manner or adequately remediate any such incident. Due to applicable laws, rules and regulations or contractual obligations, CSX may be held responsible for data breaches, cyber-attacks or other similar incidents attributed to its third-party vendors as they relate to the information CSX shares with them. Additionally, if CSX is unable to successfully acquire, develop or implement new technology, including artificial intelligence, it may suffer a competitive disadvantage within the rail industry and with companies providing other modes of transportation services.

PART I The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents. These incidents may include, among other things, malware, ransomware, distributed denial of service attacks, social engineering, phishing, theft, malfeasance or improper access by employees or third-party vendors, human error, fraud, or other modes of attack or disruption. Attacks of these nature are increasing in frequency, levels of persistence, intensity and sophistication. Further, the Company may be at increased risk of a cyber-attack as a result of being a component of the critical U.S. infrastructure. As cybersecurity threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities, data breaches, cyber-attacks or other similar incidents. A public health crisis could also increase the risk that the Company or its third-party vendors may experience cybersecurity incidents as a result of employees, third-party vendors and other third parties with which they interact working remotely on less secure systems and environments. Despite the Company’s efforts to protect its information technology systems, it may not be able to prevent or anticipate all data breaches, cyber-attacks or other similar incidents, detect or react to such incidents in a timely manner or adequately remediate any such incident. While CSX’s security protocols have detected attempts to gain unauthorized access to the Company’s information technology systems, none of such attempts have resulted in any material breach of or disruption to the Company’s systems. For example, CSX has experienced distributed denial of service attacks that have resulted in brief system disruptions, but none have resulted in access to CSX systems. Additionally, despite routine security assessment of the Company’s key third-party vendors, some vendors have experienced cyber-attacks in the past, but none of such attacks have had a material adverse impact on CSX’s business or operations. Due to applicable laws and regulations or contractual obligations, CSX may be held responsible for data breaches, cyber-attacks or other similar incidents attributed to its third-party vendors as they relate to the information CSX shares with them. Additionally, if CSX is unable to acquire, develop or implement new technology, it may suffer a competitive disadvantage within the rail industry and with companies providing other modes of transportation service.

Most of CSX's employees are represented by labor unions and are covered by collective bargaining agreements. These agreements are either bargained for nationally by the National Carriers Conference Committee or locally between CSX and the union. Such agreements are negotiated over the course of several years and previously have not resulted in any extended work stoppages. Under the Railway Labor Act's procedures (which include mediation, cooling-off periods and the possibility of an intervention by the President of the United States), during negotiations neither party may take action until the procedures are exhausted. If, however, CSX is unable to negotiate acceptable agreements, the employees covered by the Railway Labor Act could strike, which could result in loss of business and increased operating costs as a result of higher wages or benefits paid to union members.

Most of CSX's employees are represented by labor unions and are covered by collective bargaining agreements. These agreements are either bargained for nationally by the National Carriers Conference Committee or locally between CSX and the union. Such agreements are negotiated over the course of several years and previously have not resulted in any extended work stoppages. Under the Railway Labor Act's procedures (which include mediation, cooling-off periods and the possibility of an intervention by the President of the United States), during negotiations neither party may take action until the procedures are exhausted. If, however, CSX is unable to negotiate acceptable agreements, the employees covered by the Railway Labor Act could strike, which could result in loss of business and increased operating costs as a result of higher wages or benefits paid to union members. CSX 2022 Form 10-K p.11 CSX 2022 Form 10-K p.11 CSX 2022 Form 10-K p.11 CSX 2022 Form 10-K p.11 CSX 2022 Form 10-K p.11 CSX 2022 Form 10-K p.11

A decline or disruption in general domestic and global economic conditions that affects demand for the commodities and products the Company transports, including import and export volume, could reduce revenues or have other adverse effects on the Company's cost structure and profitability. For example, slower rates of economic growth in Asia, contraction of European economies, and changes in the global supply of seaborne coal or price of seaborne coal have adverse impacts on U.S. export coal volume and result in lower coal revenue for CSX. Additionally, embargoes or changes to trade agreements or policies could result in reduced import and export volumes due to increased tariffs and lower consumer demand. If the Company experiences significant declines in demand for its transportation services with respect to one or more commodities and products or continues to experience the impacts of inflation, the Company may experience reduced revenue and increased operating costs, workforce adjustments, and other related activities, which could have a material adverse effect on the Company's financial condition, results of operations and liquidity.

A decline or disruption in general domestic and global economic conditions that affects demand for the commodities and products the Company transports, including import and export volume, could reduce revenues or have other adverse effects on the Company's cost structure and profitability. For example, slower rates of economic growth in Asia, contraction of European economies, and changes in the global supply of seaborne coal or price of seaborne coal have adverse impacts on U.S. export coal volume and result in lower coal revenue for CSX. Additionally, changes to trade agreements or policies could result in reduced import and export volumes due to increased tariffs and lower consumer demand. If the Company experiences significant declines in demand for its transportation services with respect to one or more commodities and products or continues to experience the impacts of inflation, the Company may experience reduced revenue and increased operating costs, workforce adjustments, and other related activities, which could have a material adverse effect on the Company's financial condition, results of operations and liquidity. CSX 2022 Form 10-K p.10 CSX 2022 Form 10-K p.10 CSX 2022 Form 10-K p.10 CSX 2022 Form 10-K p.10 CSX 2022 Form 10-K p.10 CSX 2022 Form 10-K p.10

Legislation passed by Congress, new regulations issued by federal agencies, or executive orders issued by the President of the United States could significantly affect the revenues, costs, including income taxes, and profitability of the Company's business. In addition, statutes or regulations that, among other things, impose price constraints or affecting rail-to-rail competition could adversely affect the Company's profitability.

Legislation passed by Congress, new regulations issued by federal agencies or executive orders issued by the President of the United States could significantly affect the revenues, costs, including income taxes, and profitability of the Company's business. In addition, statutes or regulations imposing price constraints or affecting rail-to-rail competition could adversely affect the Company's profitability.

The Company experiences competition in pricing, service, reliability and other factors from various transportation providers including railroads and motor carriers that operate similar routes across its service area and, to a less significant extent, barges, ships and pipelines. Other transportation providers generally use public rights-of-way that are built and maintained by governmental entities, while CSXT and other railroads must build and maintain rail networks largely using internal resources. Any future improvements or expenditures materially increasing the quality or reducing the cost of alternative modes of transportation such as through the use of automation, autonomy or electrification, or legislation providing for less stringent size or weight restrictions on trucks, could negatively impact the Company's competitive position. Additionally, any future consolidation in the rail industry could materially affect the regulatory and competitive environment in which the Company operates. CSX 2023 Form 10-K p.10 CSX 2023 Form 10-K p.10 CSX 2023 Form 10-K p.10 CSX 2023 Form 10-K p.10 CSX 2023 Form 10-K p.10 CSX 2023 Form 10-K p.10

The Company experiences competition in pricing, service, reliability and other factors from various transportation providers including railroads and motor carriers that operate similar routes across its service area and, to a less significant extent, barges, ships and pipelines. Other transportation providers generally use public rights-of-way that are built and maintained by governmental entities, while CSXT and other railroads must build and maintain rail networks largely using internal resources. Any future improvements or expenditures materially increasing the quality or reducing the cost of alternative modes of transportation such as through the use of automation, autonomy or electrification, or legislation providing for less stringent size or weight restrictions on trucks, could negatively impact the Company's competitive position. Additionally, any future consolidation in the rail industry could materially affect the regulatory and competitive environment in which the Company operates.

Terrorist attacks, along with any government response to those attacks, may adversely affect the Company's financial condition, results of operations or liquidity. CSXT's rail lines, other key infrastructure and information technology systems may be targets or indirect casualties of acts of terror or war. This risk could cause significant business interruption and result in increased costs and liabilities and decreased revenues. In addition, premiums charged for some or all of the insurance coverage currently maintained by the Company could increase dramatically, or the coverage may no longer be available. Furthermore, in response to the heightened risk of terrorism, federal, state and local governmental bodies are proposing and, in some cases, have adopted legislation and regulations relating to security issues that impact the transportation industry. For example, the Department of Homeland Security adopted regulations that require freight railroads to implement additional security protocols when transporting hazardous materials. Complying with these or future regulations could continue to increase the Company's operating costs and reduce operating efficiencies.

Terrorist attacks, along with any government response to those attacks, may adversely affect the Company's financial condition, results of operations or liquidity. CSXT's rail lines, other key infrastructure and information technology systems may be targets or indirect casualties of acts of terror or war. This risk could cause significant business interruption and result in increased costs and liabilities and decreased revenues. In addition, premiums charged for some or all of the insurance coverage currently maintained by the Company could increase dramatically, or the coverage may no longer be available. CSX 2022 Form 10-K p.9 CSX 2022 Form 10-K p.9 CSX 2022 Form 10-K p.9 CSX 2022 Form 10-K p.9 CSX 2022 Form 10-K p.9 CSX 2022 Form 10-K p.9

There is potential for operational impacts from changing weather patterns or rising sea levels in the Company's operational territory, which could impact the Company's network or other assets. Climate change and other emissions-related laws and regulations have been proposed and, in some cases adopted, on the federal, state, provincial and local levels. These final and proposed laws and regulations take the form of restrictions, caps, taxes or other controls on emissions as well as requirements to disclose information relating to climate change. In particular, the EPA has issued various regulations and may issue additional regulations targeting emissions, including rules and standards governing emissions from certain stationary sources and from vehicles. Any of these pending or proposed laws or regulations, could adversely affect the Company's operations and financial results by, among other things: (i) reducing coal-fired electricity generation due to mandated emission standards; (ii) reducing the consumption of coal as a viable energy resource in the United States and Canada; (iii) increasing the Company's fuel, capital and other operating costs and negatively affecting operating and fuel efficiencies; and (iv) making it difficult for the Company's customers in the U.S. and Canada to produce products in a cost competitive manner. Any of these factors could reduce the amount of shipments the Company handles and have a material adverse effect on the Company's financial condition, results of operations or liquidity. In addition, CSX may become subject to legal requirements to disclose climate change related information and may become subject to demands or expectations by its supply chain partners, customers or other stakeholders to disclose information relating to climate risk or set related targets or goals. The Company's current practices with respect to climate risk disclosure may fail to meet these developing legal requirements or stakeholder demands or expectations. In addition, legislative or regulatory uncertainties and change regarding climate-related risks, including inconsistent perspectives or requirements, are likely to result in higher regulatory, compliance, credit, reputational and other risks and costs. CSX 2023 Form 10-K p.12 CSX 2023 Form 10-K p.12 CSX 2023 Form 10-K p.12 CSX 2023 Form 10-K p.12 CSX 2023 Form 10-K p.12 CSX 2023 Form 10-K p.12

There is potential for operational impacts from changing weather patterns or rising sea levels in the Company's operational territory, which could impact the Company's network or other assets. Climate change and other emissions-related laws and regulations have been proposed and, in some cases adopted, on the federal, state, provincial and local levels. These final and proposed laws and regulations take the form of restrictions, caps, taxes or other controls on emissions. In particular, the EPA has issued various regulations and may issue additional regulations targeting emissions, including rules and standards governing emissions from certain stationary sources and from vehicles. Any of these pending or proposed laws or regulations, including any proposed or implemented under the Biden administration, could adversely affect the Company's operations and financial results by, among other things: (i) reducing coal-fired electricity generation due to mandated emission standards; (ii) reducing the consumption of coal as a viable energy resource in the United States and Canada; (iii) increasing the Company's fuel, capital and other operating costs and negatively affecting operating and fuel efficiencies; and (iv) making it difficult for the Company's customers in the U.S. and Canada to produce products in a cost competitive manner. Any of these factors could reduce the amount of shipments the Company handles and have a material adverse effect on the Company's financial condition, results of operations or liquidity.

Marketplace conditions for resources like locomotives as well as the availability of qualified personnel, including engineers and conductors as well as other skilled professional or technical employees, could each have a negative impact on the Company’s ability to meet demand for rail service. Although the Company strives to maintain adequate resources and personnel for the current business environment, unpredictable increases in demand for rail services or extreme weather conditions may exacerbate such risks, which could have a negative impact on the Company’s operational efficiency and otherwise have a material adverse effect on the Company’s financial condition, results of operations, or liquidity in a particular period. CSX 2023 Form 10-K p.11 CSX 2023 Form 10-K p.11 CSX 2023 Form 10-K p.11 CSX 2023 Form 10-K p.11 CSX 2023 Form 10-K p.11 CSX 2023 Form 10-K p.11

Marketplace conditions for resources like locomotives as well as the availability of qualified personnel, particularly engineers and conductors, could each have a negative impact on the Company’s ability to meet demand for rail service. Although the Company strives to maintain adequate resources and personnel for the current business environment, unpredictable increases in demand for rail services or extreme weather conditions may exacerbate such risks, which could have a negative impact on the Company’s operational efficiency and otherwise have a material adverse effect on the Company’s financial condition, results of operations, or liquidity in a particular period.

CSXT is required to comply with regulations regarding the handling of hazardous materials and has a legal obligation to transport certain hazardous materials under the common carrier mandate. Applicable rules issued by the TSA place significant security and safety requirements on passenger and freight railroad carriers, rail transit systems and facilities that ship hazardous materials by rail. Noncompliance with these rules can subject the Company to significant penalties and could be a factor in litigation arising out of a train accident. Finally, legislation preventing the transport of hazardous materials through certain cities could result in network congestion and increase the length of haul for hazardous substances, which could increase operating costs, reduce operating efficiency or increase the risk of an accident involving the transport of hazardous materials. CSX 2023 Form 10-K p.7 CSX 2023 Form 10-K p.7 CSX 2023 Form 10-K p.7 CSX 2023 Form 10-K p.7 CSX 2023 Form 10-K p.7 CSX 2023 Form 10-K p.7

A train accident involving the transport of hazardous materials could result in significant claims arising from personal injury, property or natural resource damage, environmental penalties and remediation obligations. Such claims, if insured, could exceed existing insurance coverage or insurance may not continue to be available at commercially reasonable rates. Under federal regulations, CSXT is required to transport hazardous materials under the legal duty referred to as the common carrier mandate. CSXT is also required to comply with regulations regarding the handling of hazardous materials. In November 2008, the TSA issued final rules placing significant new security and safety requirements on passenger and freight railroad carriers, rail transit systems and facilities that ship hazardous materials by rail. Noncompliance with these rules can subject the Company to significant penalties and could be a factor in litigation arising out of a train accident. Finally, legislation preventing the transport of hazardous materials through certain cities could result in network congestion and increase the length of haul for hazardous substances, which could increase operating costs, reduce operating efficiency or increase the risk of an accident involving the transport of hazardous materials. CSX 2022 Form 10-K p.7 CSX 2022 Form 10-K p.7 CSX 2022 Form 10-K p.7 CSX 2022 Form 10-K p.7 CSX 2022 Form 10-K p.7 CSX 2022 Form 10-K p.7