Norfolk Southern 10-K 2025-12-31

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

for the fiscal year ended December 31, 2025

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

for the transition period from ___________ to___________

Commission File Number 1-8339

NORFOLK SOUTHERN CORPORATION

(Exact name of registrant as specified in its charter)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: NONE

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer," "accelerated filer," "smaller reporting company," and "emerging growth company" in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☒ Accelerated filer ☐ Non-accelerated filer ☐ Smaller reporting company ☐ Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of the voting common equity held by non-affiliates at June 30, 2025 was $57,481,458,868 (based on the closing price as quoted on the New York Stock Exchange on June 30, 2025).

The number of shares outstanding of each of the registrant’s classes of common stock, at January 31, 2026: 224,572,025 (excluding 20,320,777 shares held by the registrant’s consolidated subsidiaries).

DOCUMENTS INCORPORATED BY REFERENCE: Portions of the Registrant’s definitive proxy statement to be filed electronically pursuant to Regulation 14A not later than 120 days after the end of the fiscal year, are incorporated herein by reference in Part III.

TABLE OF CONTENTS

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

K2

PART I

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

GENERAL – Norfolk Southern Corporation (Norfolk Southern) is an Atlanta, Georgia-based company that owns a major freight railroad, Norfolk Southern Railway Company (NSR). We were incorporated on July 23, 1980, under the laws of the Commonwealth of Virginia. Our common stock (Common Stock) is listed on the New York Stock Exchange (NYSE) under the symbol “NSC.”

Unless indicated otherwise, Norfolk Southern Corporation and its subsidiaries, including NSR, are referred to collectively as NS, we, us, and our.

We are primarily engaged in the rail transportation of raw materials, intermediate products, and finished goods primarily in the Southeast, East, and Midwest and, via interchange with rail carriers, to and from the rest of the United States (U.S.). We also transport overseas freight through several Atlantic and Gulf Coast ports. We offer the most extensive intermodal network in the eastern half of the U.S.

We make available free of charge through our website, www.norfolksouthern.com, our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after such material is electronically filed with or furnished to the U.S. Securities and Exchange Commission (SEC). In addition, the following documents are available on our website and in print to any shareholder who requests them:

• Norfolk Southern Corporation Bylaws

• Charters of the Committees of the Board of Directors

• Corporate Governance Guidelines

• Categorical Independence Standards

• The Thoroughbred Code of Ethics

• Code of Ethical Conduct for Senior Financial Officers

Merger Agreement – On July 28, 2025, we entered into an Agreement and Plan of Merger (the “Merger Agreement”) with Union Pacific Corporation, a Utah corporation (“Union Pacific”), Ruby Merger Sub 1 Corporation, a Virginia corporation and a direct wholly owned subsidiary of Union Pacific (“Merger Sub 1”), and Ruby Merger Sub 2 LLC, a Virginia limited liability company and a direct wholly owned subsidiary of Union Pacific (“Merger Sub 2”).

The Merger Agreement provides that Union Pacific will acquire the Company in a stock-and-cash transaction whereby (a) Merger Sub 1 will be merged with and into the Company (the “First Merger”), with the Company surviving the First Merger as a direct wholly owned subsidiary of Union Pacific, and (b) immediately following the First Merger, the Company will be merged with and into Merger Sub 2 (the “Second Merger” and together with the First Merger, the “Mergers”), with Merger Sub 2 surviving the Second Merger as a direct, wholly owned subsidiary of Union Pacific.

At the effective time of the First Merger, each share of Common Stock, par value $1.00 per share, of the Company, issued and outstanding immediately prior to the effective time of the First Merger, subject to certain exclusions set forth in the Merger Agreement, will be converted into the right to receive one share of common stock, par value $2.50 per share, of Union Pacific, and $88.82 in cash without interest.

The consummation of the Mergers is subject to certain conditions, including approval by the U.S. Surface Transportation Board (STB). Additionally, if the Merger Agreement is terminated under specific circumstances, either we or Union Pacific are required to pay a termination fee of $2.5 billion.

K3

RAILROAD OPERATIONS – At December 31, 2025, we operated approximately 19,100 route miles in 22 states and the District of Columbia.

Our system reaches many manufacturing plants, electric generating facilities, mines, distribution centers, transload facilities, and other businesses located in our service area.

Corridors with heaviest freight volume:

• New York City area to Chicago (via Allentown and Pittsburgh)

• Chicago to Macon (via Cincinnati, Chattanooga, and Atlanta)

• Central Ohio to Norfolk (via Columbus and Roanoke)

• Birmingham to Meridian

• Cleveland to Kansas City

K4

The miles operated, which include an exclusive operating agreement for trackage rights over property owned by North Carolina Railroad Company, were as follows:

We operate freight service over lines with ongoing Amtrak and commuter passenger operations, including trackage owned or leased by Amtrak, New Jersey Transit, Southeastern Pennsylvania Transportation Authority, Metro-North Commuter Railroad Company, Virginia Passenger Rail Authority (VPRA), and the Michigan Department of Transportation.

The following table sets forth certain statistics relating to our operations for the past five years:

RAILWAY OPERATING REVENUES – Total railway operating revenues were $12.2 billion in 2025. Following is an overview of our three commodity groups. See the discussion of merchandise revenues by major commodity group, intermodal revenues, and coal revenues and tonnage in Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

MERCHANDISE – Our merchandise commodity group is composed of four groupings:

• Agriculture, forest and consumer products includes soybeans, wheat, corn, fertilizer, livestock and poultry feed, food products, food oils, flour, sweeteners, ethanol, lumber and wood products, pulp board and paper products, wood fibers, wood pulp, beverages, and canned goods.

• Chemicals includes sulfur and related chemicals, petroleum products (including crude oil), chlorine and bleaching compounds, plastics, rubber, industrial chemicals, chemical wastes, sand, and natural gas liquids.

• Metals and construction includes steel, aluminum products, machinery, scrap metals, cement, aggregates, minerals, clay, transportation equipment, and items for the U.S. military.

• Automotive includes finished motor vehicles and automotive parts.

In 2025, we handled 2.3 million merchandise carloads, which accounted for 63% of our total railway operating revenues.

K5

INTERMODAL – Our intermodal commodity group consists of shipments moving in domestic and international containers and trailers. These shipments are handled on behalf of intermodal marketing companies, international steamship lines, premium customers, and asset-owning companies. In 2025, we handled 4.1 million intermodal units, which accounted for 25% of our total railway operating revenues.

COAL – Coal revenues accounted for 12% of our total railway operating revenues in 2025. We handled 78.0 million tons, or 0.7 million carloads, most of which originated on our lines from major eastern coal basins with the balance from major western coal basins received via the Memphis and Chicago gateways. Our coal franchise supports the electric generation market, directly serving 18 coal-fired power plants, as well as the export, domestic metallurgical, and industrial markets, primarily through direct rail and river, lake, and coastal facilities, including various terminals on the Ohio River, at Lamberts Point in Norfolk, Virginia, at the Port of Baltimore, at McDuffie Coal Terminal in Mobile, AL, and on Lake Erie.

FREIGHT RATES – Our predominant pricing mechanisms, private contracts and exempt price quotes, are not subject to regulation. In general, market forces are the primary determinant of rail service prices.

RAILWAY PROPERTY

Our railroad infrastructure makes us capital intensive with net properties of approximately $36 billion on a historical cost basis.

Property Additions – Property additions for the past five years were as follows:

Our capital spending and replacement programs are and have been designed to support our ability to provide safe, efficient, and reliable rail transportation services.

K6

Equipment – Our equipment includes owned and leased locomotives and railcars; maintenance of way equipment and machinery; other equipment and tools used in our shops, offices, and facilities; and vehicles and other equipment used for maintenance, transportation, and other activities. Our equipment includes both owned equipment acquired by us and equipment held under lease arrangements. At December 31, 2025, we owned or leased the following revenue generating equipment:

The following table indicates the number and year built for locomotives and freight cars owned at December 31, 2025:

K7

The following table shows the average age of our owned locomotive and freight car fleets at December 31, 2025 and information regarding 2025 retirements:

Track Maintenance – Of the 35,000 total miles of track on which we operate, we are responsible for maintaining 28,200 miles, with the remainder being operated under trackage rights from other parties responsible for maintenance.

Over 85% of the main line trackage (including first, second, third, and branch main tracks, all excluding rail operated pursuant to trackage rights) has rail ranging from 131 to 155 pounds per yard with the standard installation currently at 136 pounds per yard. Approximately 40% of our lines, excluding rail operated pursuant to trackage rights, carried 20 million or more gross tons per track mile during 2025.

The following table summarizes several measurements regarding our track roadway additions and replacements during the past five years:

Traffic Control – Of the 16,200 route miles we dispatch, 10,300 miles incorporate signalization. This includes 8,600 miles governed by Centralized Traffic Control, 1,700 miles utilizing Automatic Block Signals, and 600 miles utilizing Cab Signals. The majority of these locations are controlled wirelessly through NS’s Interoperable Train Control Messaging and Advanced Train Control System communications networks and associated infrastructure.

ENVIRONMENTAL MATTERS – Compliance with laws and regulations relating to the protection of the environment is one of our principal goals. With the exception of our response to the Eastern Ohio Incident (the “Incident” as defined in Note 19) such compliance has not had a material effect on our financial position, results of operations, or liquidity. For further information on the Incident and environmental matters, see Note 19 in Item 8 “Notes to Consolidated Financial Statements.”

HUMAN CAPITAL MANAGEMENT

Workforce – We employed an average of 19,400 employees during 2025 and 19,300 employees at the end of 2025. Approximately 80% of our railroad employees are covered by collective bargaining agreements with various labor unions and referred to as “craft” employees. See the discussion of “Labor Agreements” in Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The remainder of our workforce is composed of management employees.

Safety – Safety is a core value at Norfolk Southern. We are dedicated to providing employees with a safe workplace and the knowledge and tools they need to work safely and return home safely every day. Our commitment to an injury-free workplace is outlined in our Risk Reduction Program, which focuses on safety policies and procedures, risk-based hazard management program, safety outreach and communications, technology analysis and implementation, and collaboration with craft employees. Our safety programs, practices, and messaging further reinforce the importance of working safely including the imperative to speak up with ideas and concerns as well as reinforce the universal authority to stop work if ever unsure or detect a risk that is not adequately safeguarded. We measure employee safety performance through internal metrics such as accidents, injuries, and serious injuries per 200,000 employee-hours. We also use metrics established by the Federal Railroad

K8

Administration (FRA) to measure FRA-reportable accidents per million train miles and injuries per 200,000 employee-hours. Given that safety continues to be a top priority, and the importance of safety among our workforce and to our business, our Board of Directors (Board) has a standing Safety Committee that, among other duties, reviews, monitors, and evaluates our compliance with our safety programs and practices.

Craft Workforce Levels and Productivity – Maintaining appropriate headcount levels for our craft-employee workforce is critical to our on-time and consistent delivery of customers’ goods and operational efficiency goals. We manage this human capital metric through strategic cross functional teams from multiple departments who utilize forecasting tools designed to ensure the optimal level of staffing to meet business demands. We measure and monitor employee productivity based on various factors, including gross ton miles per train and engine employee.

Attracting and Retaining Management Employees – Our talent strategy for management employees is essential to attracting strong candidates in a competitive talent environment. We evaluate the effectiveness of that strategy by studying market trends, benchmarking the attractiveness of our employee value proposition, maintaining a competitive compensation package, and analyzing retention data.

We also focus on driving employee engagement, which is key to increasing employee productivity, retention, and safety. We take a data-centric approach, including the use of ongoing surveys among employees, to identify new initiatives that will help boost engagement and drive business results.

Employee Development and Training – We provide a range of developmental programs, opportunities, skills, and resources for our employees to be successful in their careers. We provide classroom instruction, hands-on training and simulation-based training designed to improve on-the-job effectiveness and safety outcomes.

We also use modern learning and performance technologies to offer robust professional growth opportunities. Through on-demand digital course offerings, custom-built learning paths, and in-person facilitated content, our programs provide a holistic and inclusive approach to professional development throughout an employee's career.

Workplace Experience – As a leading transportation service company, we recognize that success in the global marketplace relies on the recruitment and retention of top-tier talent, as well as leveraging the expertise and experiences of individuals from all backgrounds.

In pursuit of this goal, we are dedicated to establishing a workplace where a broad spectrum of identities, perspectives, and experiences is not only represented but also valued and enabled to deliver outstanding results.

GOVERNMENT REGULATION – In addition to environmental, safety, securities, and other regulations generally applicable to all business, our railroads are subject to regulation by the STB. The STB has jurisdiction to varying extents over rates, routes, customer access provisions, fuel surcharges, conditions of service, and the extension or abandonment of rail lines. The STB has jurisdiction to determine whether we are “revenue adequate” on an annual basis based on the results of the prior year. A railroad is “revenue adequate” on an annual basis under the applicable law when its return on net investment exceeds the rail industry’s composite cost of capital. This determination is made pursuant to a statutory requirement. The STB also has jurisdiction over the consolidation, merger, or acquisition of control of and by rail common carriers.

The relaxation of economic regulation of railroads, following the Staggers Rail Act of 1980, included exemption from STB regulation of the rates and most service terms for intermodal business (trailer-on-flat-car, container-on-flat-car), rail boxcar shipments, lumber, manufactured steel, automobiles, and certain bulk commodities such as sand, gravel, pulpwood, and wood chips for paper manufacturing. Further, all shipments that we have under contract are effectively removed from commercial regulation for the duration of the contract. Approximately 90% of our revenues comes from either exempt shipments or shipments moving under transportation contracts; the remainder comes from shipments moving under public tariff rates.

K9

Efforts have been made over the past several years to increase federal economic regulation of the rail industry, and such efforts may continue in 2026. The Staggers Rail Act of 1980 substantially balanced the interests of shippers and rail carriers, and encouraged and enabled rail carriers to innovate, invest in their infrastructure, and compete for business, thereby contributing to the economic health of the nation and to the revitalization of the industry. Accordingly, we will continue to oppose efforts to reimpose increased economic regulation.

Railroads are also subject to the enactment of laws by Congress and regulation by the U.S. Department of Transportation (DOT) (including the FRA) and the U.S. Department of Homeland Security (DHS) (including the Transportation Security Administration (TSA)), which regulate most aspects of our operations related to safety, security, and cybersecurity.

Government regulations are further discussed within Item 1A “Risk Factors,” and the safety and security of our railroads are discussed within the “Security of Operations” section contained herein.

COMPETITION – There is continuing strong competition among rail, water, and highway carriers. Price is usually only one factor of importance as shippers and receivers choose a transport mode and specific hauling company. Inventory carrying costs, service reliability, ease of handling, and the desire to avoid loss and damage during transit are also important considerations, especially for higher-valued finished goods, machinery, and consumer products. Even for raw materials, semi-finished goods, and work-in-progress, users are increasingly sensitive to transport arrangements that minimize problems at successive production stages.

Our primary rail competitor is CSX Corporation (CSX); both we and CSX operate throughout much of the same territory. Other railroads also operate in parts of the territory. We also compete with motor carriers, water carriers, and with shippers who have the additional options of handling their own goods in private carriage, sourcing products from different geographic areas, and using substitute products.

Certain marketing strategies to expand reach and shipping options among railroads and between railroads and motor carriers enable railroads to compete more effectively in specific markets.

SECURITY OF OPERATIONS – We continue to enhance the security of our rail system. Our comprehensive security plan is modeled on and was developed in conjunction with the security plan prepared by the Association of American Railroads (AAR) post September 11, 2001. The AAR Security Plan defines four Alert Levels and details the actions and countermeasures that are being applied across the railroad industry as the risk of terrorist, extremist, or seriously disruptive cyber-attack increases or decreases. The Alert Level actions include countermeasures that will be applied in three general areas: (1) operations (including transportation, engineering, and mechanical); (2) information technology and communications; and, (3) railroad police. All of our Operations Division employees are advised by their supervisors or train dispatchers, as appropriate, of any change in Alert Level and any additional responsibilities they may incur due to such change.

Our security plan also complies with DOT security regulations pertaining to training and security plans with respect to the transportation of hazardous materials. As part of the plan, security awareness training is given to all railroad employees who directly affect hazardous material transportation safety and is integrated into hazardous material training programs. Additionally, location-specific security plans are in place for rail corridors in certain metropolitan areas referred to as High Threat Urban Areas (HTUA). Particular attention is aimed at reducing risk in a HTUA by: (1) the establishment of secure storage areas for rail cars carrying toxic-by-inhalation (TIH) materials; (2) the expedited movement of trains transporting rail cars carrying TIH materials; (3) reducing the number of unattended loaded tank cars carrying TIH materials; and (4) cooperation with federal, state, local, and tribal governments to identify those locations where security risks are the highest.

We also operate four facilities that are under U.S. Coast Guard (USCG) Maritime Security Regulations. With respect to these facilities, each facility’s security plan has been approved by the applicable Captain of the Port and remains subject to inspection by the USCG.

K10

Additionally, we continue to engage in close and regular coordination with numerous federal and state agencies, including the DHS, the TSA, the Federal Bureau of Investigation, the FRA, the USCG, U.S. Customs and Border Protection, the Department of Defense, and various state Homeland Security offices.

In 2025, through the Norfolk Southern Operation Awareness and Response Program as well as participation in the Transportation Community Awareness and Emergency Response Program, we provided rail accident response training to more than 5,800 emergency responders, such as local police and fire personnel, utilizing a combination of online training and face-to-face training sessions as well as the Norfolk Southern Safety Train. We also have ongoing programs to sponsor local emergency responders at the Security and Emergency Response Training Center.

We also continually evaluate ourselves for appropriate business continuity and disaster recovery planning, with test scenarios that include cybersecurity attacks. Our risk-based information security program helps ensure our defenses and resources are aligned to address the most likely and most damaging potential attacks, to provide support for our organizational mission and operational objectives, and to keep us in the best position to detect, mitigate, and recover from a wide variety of potential attacks in a timely fashion.

The risks set forth in the following risk factors could have a material adverse effect on our financial position, results of operations, or liquidity in a particular year or quarter, and could cause those results to differ materially from those expressed or implied in our forward-looking statements. The information set forth in this Item 1A “Risk Factors” should be read in conjunction with the rest of the information included in this annual report, including

Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and Item 8 “Financial Statements and Supplementary Data.” We have experienced a number of the risks described below in connection with the Incident and the Incident Proceedings (defined below). The risks described below should be read in conjunction with the information regarding the Incident and Incident Proceedings provided in Note 19 in Item 8 “Notes to Consolidated Financial Statements.”

RISKS RELATED TO THE MERGERS

We have identified certain additional risk factors in connection with the Mergers. For additional information concerning these risks, uncertainties and assumptions, please refer to the section entitled “Risk Factors” included in our proxy statement filed with the SEC on October 1, 2025.

The Mergers are subject to conditions, some or all of which may not be satisfied or completed on a timely basis, if at all. Failure to complete the Mergers could have material adverse effects on the Company. The completion of the Mergers is subject to a number of conditions, including, among others, the receipt of the requisite regulatory approvals, which make the completion of the Mergers and timing thereof uncertain. Also, either Union Pacific or the Company may terminate the Merger Agreement if the Mergers have not been consummated by the end date (subject to an automatic extension in certain circumstances), except that this right to terminate the Merger Agreement will not be available to any party whose failure to perform any obligation under the Merger Agreement has been the primary cause of the failure of the Mergers to be consummated on or before that date.

If the Mergers are not completed, the Company’s ongoing business may be materially adversely affected and, without realizing any of the benefits of having completed the Mergers, the Company will be subject to a number of risks, including the following:

• the market price of the Company’s Common Stock could decline;

• the Company could owe substantial termination fees to Union Pacific under certain circumstances;

• if the Merger Agreement is terminated and the Union Pacific board or the Company’s board seeks another business combination, Union Pacific shareholders and Norfolk Southern shareholders cannot be certain that Union Pacific or the Company will be able to find a party willing to enter into a transaction on terms equivalent to or more attractive than the terms that the other party has agreed to in the Merger Agreement;

K11

• time, resources, and costs committed by the Company’s management team to matters relating to the Mergers could otherwise have been devoted to pursuing other beneficial opportunities;

• negative reactions from the financial markets or from its customers (certain of whom have and may continue to diversify their distribution networks, including in response to actions by our competitors), suppliers, employees, labor unions, or other business partners; and

• the Company will be required to pay its respective costs relating to the Mergers, such as legal, accounting, financial advisory, and printing fees, whether or not the Mergers are completed.

In addition, if the Mergers are not completed, the Company could be subject to litigation related to any failure to complete the Mergers or related to any enforcement proceeding commenced against the Company to perform its obligations under the Merger Agreement, and whether or not any such litigation has any merit, the cost of defending such litigation may be significant. The materialization of any of these risks could adversely impact the Company’s ongoing business.

Similarly, delays in the completion of the Mergers could, among other things, result in additional transaction costs, loss of revenue, or other negative effects associated with uncertainty about completion of the Mergers.

The Mergers are subject to the receipt of the requisite regulatory approvals, which requisite regulatory approvals may never be obtained, therefore preventing completion of the Mergers. In addition, in granting such approvals, regulatory authorities may impose conditions that could have a significant adverse effect on the Company or the combined company and the expected benefits of the Mergers therefore preventing completion of the Mergers. Before the Mergers may be completed, the requisite regulatory approvals must have been obtained, including STB approval. While the initial Merger application with the STB was determined to be incomplete, the Company and Union Pacific are in process of preparing a revised application that incorporates the additional items identified by the STB. The terms and conditions of the approvals that are granted may impose requirements, concessions, limitations, or costs or place restrictions on the conduct of the combined company’s business. Subject to the terms and conditions of the Merger Agreement, Union Pacific and the Company have each agreed to use their reasonable best efforts to take, or cause to be taken, all actions, and to do, or cause to be done, and to assist and cooperate with each other in doing, all things necessary, proper, or advisable to cause the conditions to closing set forth in the Merger Agreement to be satisfied and to consummate and make effective the Mergers and the other transactions contemplated by the Merger Agreement prior to the end date, except that Union Pacific and its subsidiaries are not required to take, or commit to take, or agree to or accept any “materially burdensome regulatory condition.” For purposes of the foregoing, “reasonable best efforts” includes, among others, (i) proposing, negotiating, committing to, and effecting, by consent decree, hold separate order, or otherwise, the sale, divestiture, license, hold separate, or disposition of any and all of the share capital or other equity interest, assets, products, or businesses of Union Pacific and its subsidiaries or of the Company and its subsidiaries and (ii) otherwise taking or committing to take any actions that after the first effective time would limit Union Pacific’s or its subsidiaries’ freedom of action with respect to, or their ability to retain, or otherwise agreeing to any restriction, requirement, or limitation with respect to their or one or more of their subsidiaries’ assets, products, or businesses, in each case as may be required in order to avoid the entry of, or to effect the dissolution of, any injunction, temporary restraining order, or other order that would otherwise have the effect of preventing or delaying the closing. The STB and other regulatory and governmental authorities may impose requirements, concessions, and other conditions on the granting of such approvals. If such regulatory and governmental authorities seek to impose such requirements, concessions, or conditions, lengthy negotiations may ensue among such authorities, Union Pacific and the Company. Such requirements, concessions, and conditions and the process of obtaining regulatory approvals could have the effect of delaying completion of the Mergers and such requirements, concessions, and conditions may not be identified or satisfied for an extended period of time following the Union Pacific special meeting and the Company’s special meeting. Such requirements, concessions and conditions may also impose additional costs or limitations on the combined company following the completion of the Mergers and the parties have agreed to accept such requirements, concessions, and conditions, even if significant, subject to the agreed-upon materially burdensome regulatory condition limitation in favor of Union Pacific. These requirements, concessions, and conditions may therefore reduce the anticipated benefits of the Mergers, including synergies, which could also have a significant adverse effect on the combined company’s business and cash flows and results of operations, and

K12

neither Union Pacific nor the Company can predict what, if any, requirements, concessions, and conditions may be required by regulatory or governmental authorities whose approvals are required. The requisite regulatory approvals may not be obtained at all, may not be obtained in a timely fashion, and may contain conditions on the completion of the Mergers.

In addition, under existing law, railroad competitors and customers of Union Pacific and the Company and other interested parties may intervene to oppose the STB application or seek protective conditions in the event approval by the STB is granted, which might affect the decision of the STB, delay the approval process, or reduce the anticipated benefits of the Mergers. Furthermore, if the STB does not provide final approval or imposes conditions on its approval in a final order, and Union Pacific and the Company decide to appeal such final order from the STB, any such appeal might not be resolved for a substantial period of time after the entry of such order by the STB.

The Company is subject to business uncertainties and contractual restrictions while the Mergers are pending, which could adversely affect the Company’s business and operations. In connection with the pendency of the Mergers, some customers, suppliers, and other persons with whom the Company has a business relationship have or may delay or defer certain business decisions or terminate, change, or renegotiate their relationships with the Company, as the case may be, as a result of the Mergers or responsive actions taken by one or more of our competitors, which could negatively affect the Company’s revenues, earnings, and cash flows, as well as the market price of the Company’s Common Stock, regardless of whether the Mergers are completed.

Under the terms of the Merger Agreement, the Company is subject to certain restrictions on the conduct of its business prior to completing the first Merger, which may adversely affect its ability to execute certain of its business strategies, including the ability in certain cases to enter into or amend contracts, acquire or dispose of assets, incur indebtedness, incur capital expenditures, settle litigation, amend organizational documents, declare dividends, enter new business lines, and invest in third parties. Such limitations could adversely affect the Company’s businesses and operations prior to the completion of the Mergers.

Uncertainties associated with the Mergers may cause a loss of management personnel and other key employees, and the Company may have difficulty attracting and motivating management personnel and other key employees. The Company is dependent on the experience and industry knowledge of its management personnel and other key employees to execute its business plans. The combined company’s success after the completion of the Mergers will depend in part upon the ability of the Company to attract and retain key management personnel and other key employees. Prior to completion of the Mergers, current and prospective employees of the Company may experience uncertainty about their roles within the combined company following the completion of the Mergers, which may have an adverse effect on the ability of the Company to attract or retain management personnel and other key employees.

Each of the risks described above may be exacerbated by delays or other adverse developments with respect to the completion of the Mergers.

INCIDENT RISKS

As defined and as further described in Note 19 in Item 8 “Notes to Consolidated Financial Statements,” there was an Incident that occurred in the first quarter of 2023 that consisted of a February 3, 2023 train derailment in East Palestine, Ohio that included 11 non-Company-owned tank cars containing hazardous materials, fires associated with the derailment that threatened certain of the tank cars, and a controlled vent and burn procedure conducted on February 6, 2023 on five of the derailed tank cars, all of which contained vinyl chloride. As a result of the Incident, we became subject to numerous legal, regulatory, legislative, and other proceedings related thereto, including but not limited to, the National Transportation Safety Board (NTSB) Investigation, the FRA Incident Investigation, the FRA Safety Assessment, the U.S. Department of Justice (DOJ) Complaint, the Ohio Complaint, the Incident Lawsuits, the Shareholder Matters, and the Incident Inquiries and Investigations (each as defined in Note 19 in Item 8 “Notes to Consolidated Financial Statements”) in addition to other proceedings, actions, or potential changes in response to the Incident, including but not limited to those related to, among other items, train size, train length,

K13

train composition, crew size, or detection systems (collectively, the “Incident Proceedings”). Set forth below are additional risks pertaining to an investment in the Company that are related to the Incident and the Incident Proceedings.

The costs, liabilities, fines, penalties, and/or financial impact resulting from or related to the Incident or the Incident Proceedings have been significant to date, may exceed expected or accrued amounts, and have and can be expected to continue to negatively affect our financial results. We have incurred and will continue to remain subject to incurring significant costs, liabilities, fines, and penalties related to the Incident and the Incident Proceedings, including amounts that may have a material adverse effect on our financial position, results of operations, or liquidity.

While we have accrued estimates of probable and reasonably estimable liabilities with respect to the Incident and the Incident Proceedings, we cannot predict the final outcome or estimate the reasonably possible range of loss with certainty, and such estimates may change over time due to a variety of factors, including but not limited to those set forth in Note 19 in Item 8 “Notes to Consolidated Financial Statements” or other unfavorable or unexpected developments or outcomes which could result in our current estimates being insufficient. These estimated amounts also do not include any estimate of loss for specific items for which we believe a loss is either not probable or not reasonably estimable for the reasons set forth in Note 19 in Item 8 “Notes to Consolidated Financial Statements.” As a result, our currently accrued amounts of estimated liabilities may be insufficient, and any additional, new or updated accruals could have a material adverse effect on our results of operations or financial position.

New or additional governmental regulation and/or operational changes resulting from or related to the Incident or the Incident Proceedings may negatively impact us, our customers, the rail industry, or the markets we serve. The legislative, regulatory, operational, or other actions taken, protocols adopted (including by us), or changes resulting from the Incident or any of the Incident Proceedings may, either individually or in the aggregate, have a material adverse effect on us, our customers, the rail industry, or the markets we serve. We also face risks from requirements that may be imposed by the government in resolution of government actions, including, for example, restrictions on our methods of operations. Our inability to comply with the requirements of any new or additional laws, regulations, or operating protocols resulting from or related to the Incident or the Incident Proceedings may have a material adverse effect on our financial position, results of operations, liquidity, or operations.

REGULATORY AND LEGISLATIVE RISKS

Governmental legislation, regulation, and Executive Orders over commercial, operational, tax, safety, security, or cybersecurity matters could negatively affect us, our customers, the rail industry, or the markets we serve. Congress can enact laws, agencies can promulgate regulations, and Executive Orders can be issued that increase or alter regulation in a way that negatively affects us, our customers, the rail industry, or the markets we serve. Railroads presently are subject to commercial and operational regulation by the STB, which has jurisdiction to varying extents over rates, routes, customer access provisions, fuel surcharges, conditions of service, and the extension or abandonment of rail lines.

The STB also has jurisdiction over the consolidation, merger, or acquisition of control of and by rail common carriers. Additional, updated, or changed oversight and regulation of the rail industry by Congress or the STB, whether under new, existing, amended, or repealed laws or regulations, including but not limited to those pertaining to reciprocal switching, if imposed, could have a significant negative impact on our ability to negotiate prices for rail services, on our railway operating revenues, and on the efficiency, conduct, or complexity of our operations. Such additional or updated industry regulation, as well as enactment of any new or updated tax laws, could also negatively impact cash flows from our operating activities and, therefore, result in reduced capital spending on our rail network or abandonment of lines.

Railroads are also subject to the enactment of laws by Congress and regulation by the DOT (including the FRA) and the DHS (including the TSA), which regulate many aspects of our operations related to safety, security, and

K14

cybersecurity. Additional or updated safety, security, or cybersecurity regulation by Congress, the DOT, or DHS could have a negative impact on our business and the efficiency, conduct, or complexity of our operations including (but not limited to) increased operating costs, capital expenditures, claims, and litigation.

Our inability to comply with, or operational practices and costs necessary to adhere to, the requirements of existing or updated laws, regulations, or Executive Orders that govern our operations or the rail industry, including but not limited to those pertaining to commercial, operational, tax, safety, security, or cybersecurity matters, as such requirements may be interpreted or enforced from time to time (such as in connection with a pending regulatory or other legal proceedings or lawsuits), could have a material adverse effect on our financial position, results of operations, or liquidity.

We are addressing multiple governmental actions as a result of the Incident, as noted in “Incident Risks” above.

Federal and state environmental laws and regulations could negatively impact us and our operations. Our operations are subject to extensive federal, state and local environmental laws and regulations concerning, among other things: emissions to the air; discharges to waterways or groundwater supplies; handling, storage, transportation, use, and disposal of waste and other materials; and, the cleanup of hazardous material or petroleum releases. The risk of incurring environmental liability, for acts and omissions, past, present, and future, is inherent in the railroad business. This risk includes property owned by us, whether currently or in the past, that is or has been subject to a variety of uses, including our railroad operations and other industrial activity by past owners or our past and present tenants.

Environmental problems that are latent or undisclosed may exist on these properties, and we could incur environmental liabilities or costs, the amount and materiality of which cannot be estimated reliably at this time, with respect to one or more of these properties. Moreover, lawsuits and claims involving other unidentified environmental sites and matters are likely to arise from time to time.

Our inability to comply with the extensive federal, state and local environmental laws and regulations to which we are subject could result in significant liabilities, fines, or sanctions, including those related to the investigation or remediation of known and unknown environmental contamination, or otherwise adversely impact our operations.

U.S. international trade relationships may adversely impact our customers, our industry, and our business. We transport a significant number of shipments that have either been imported into the U.S. or are destined for export from the U.S. Trade discussions and arrangements between the U.S. and various of its trading partners are fluid, and existing and future trade agreements are, and are expected to continue to be, subject to a number of uncertainties, including the imposition of new tariffs or adjustments and changes to the products covered by existing tariffs. Any decision by the U.S. government to adopt actions such as border taxes on imports, an increase in customs duties or tariffs, or the renegotiation of U.S. trade agreements, or any other action that could have a negative impact on international trade, including corresponding actions taken by other countries in response to U.S. governmental actions, could cause a reduction in the volume of shipments by many of our customers. Any changes in tax and trade policies in the U.S. and corresponding actions by other countries could adversely impact our financial performance.

In addition, compliance with any new laws, regulations, or policies with regard to any of the foregoing may increase our operating costs or require significant capital expenditures. Any failure to comply with applicable laws, regulations or policies in the U.S. or other countries could result in substantial fines or possible revocation of our authority to conduct our operations, which could materially adversely affect us.

K15

OPERATIONAL RISKS

A significant adverse event on our network may significantly impede our ability to operate and serve our customers. The nature of our operations inherently comes with the risk that one or more significant adverse events or outages may occur on or impact our network resulting in our inability or restricted ability to provide rail transportation services to our customers. These events include but are not limited to, a mainline accident, a hazardous material discharge, a climate-related network outage, or a technology-related network outage. Any one or more of these incidents could expose us to significant operational and managerial challenges, as well as reputational damage, requiring a significant amount of time and focus of our Board and management team, as well as significant lost revenues, expenses, liabilities, fines, and penalties, including amounts that may have a material adverse effect on our financial position, results of operations, or liquidity. One or more of these events may also result in subsequent legislative, regulatory, operational or other responsive actions taken, changes or protocols adopted (including by us), or requirements imposed that may, either individually or in the aggregate, have a material adverse effect on our financial position, results of operations, liquidity, or operations, or on our customers, the rail industry, or the markets we serve.

If we are unable to successfully execute on our strategic initiatives, our business and future results of operations may suffer. Our growth strategy includes increasing the volume of shipments moving through our railway networks. We are reliant on the success of our strategic plans and initiatives to execute on this growth strategy, as well as to help offset increasing costs. These strategic plans include marketing, service, growth, and productivity initiatives. The timely and effective execution of our strategies are dependent upon, among other factors, (i) our ability to maintain satisfactory relations with our customers, employees, and other key stakeholders, (ii) our ability to effectively control costs, (iii) the progress and success of our safety programs and inspection technologies, and (iv) our ability to timely and effectively maintain and upgrade technology systems and other infrastructure for our railway networks. Our failure to successfully execute on our strategic initiatives may expose us to a number of risks, including, that our projected volume growth may differ from actual results, and prior capital investments based on our projections may contribute to excess capacity that could negatively impact our profitability.

As a common carrier by rail, we must offer to transport hazardous materials, which exposes us to significant costs and claims. Transportation of certain hazardous materials or third party-owned equipment (typically used to transport such materials) creates risks of significant losses in terms of personal injury and property (including environmental) damage and compromises critical parts of our rail network. The costs of a catastrophic rail accident involving hazardous materials or third party-owned equipment could exceed our insurance coverage. We have obtained insurance for potential losses for third-party liability and first-party property damages (see Note 19 in Item 8 “Notes to Consolidated Financial Statements”); however, insurance is available from a limited number of insurers and may not continue to be available or, if available, may not be obtainable on terms acceptable to us. Any future legislation preventing the transportation of hazardous materials through specific cities could have negative impacts including increased network congestion and operating costs, reduced operating efficiency, and increased risk of an accident involving hazardous materials.

With regard to the risks arising from the transportation of hazardous materials, the Incident and the Incident Proceedings have given rise to significant costs to us and impacts on our rail network, as noted in “Incident Risks” above. With respect to third party-owned equipment, the primary risk arises from the potential for a latent defect we are unable to identify despite robust safety inspection protocols.

We face competition from other transportation providers. We are subject to competition from motor carriers, railroads and, to a lesser extent, ships, barges, and pipelines, on the basis of transit time, pricing, and quality and reliability of service. While we have primarily used internal resources to build or acquire and maintain our rail system, trucks and barges have been able to use public rights-of-way maintained by public entities. Any future improvements, expenditures, legislation, or regulation changing or materially increasing the efficiency or reducing the cost of one or more alternative modes of transportation in the regions in which we operate (such as granting materially greater latitude for motor carriers with respect to size or weight limitations or adoption and utilization of

K16

autonomous commercial vehicles) could have a material adverse effect on our ability to compete with other modes of transportation. In addition, our industry continues to evolve, including customer demands for faster transit times and increased visibility, and the potential for increased competition (due to growth in the market, competitors with improved financial capacity or technology, or business combinations resulting in one or more competitors providing a wider variety of services and products at competitive prices) which may, either individually or in the aggregate, have a material adverse effect on our business or results of operations.

Capacity constraints could negatively impact our service and operating efficiency. We have experienced and may again experience capacity constraints on our rail network related to employee or equipment shortages, increased demand for rail services, severe weather, congestion on other railroads, including passenger activities, or impacts from changes to our network structure or composition. Such constraints could result in operational inefficiencies or adversely affect our operations.

Significant increases in demand for rail services could result in the unavailability of qualified personnel and resources like locomotives. Changes in workforce demographics, training requirements, and availability of qualified personnel, particularly for engineers and conductors, have negatively impacted and may again negatively impact our ability to meet short-term demand for rail service. Unpredicted increases in demand for rail services may exacerbate such risks and could negatively impact our operational efficiency.

Constraints on the supply chain or the operations of carriers with which we interchange may adversely affect our operations. Our ability to provide rail service to our customers depends in large part upon a functioning global supply chain and our ability to maintain collaborative relationships with connecting carriers (including shortlines and regional railroads) with respect to, among other matters, freight rates, revenue division, car supply and locomotive availability, data exchange and communications, reciprocal switching, interchange, and trackage rights. Deterioration in the supply chain or service provided by connecting carriers, or in our relationship with those connecting carriers, could result in our inability to meet our customers’ demands or require us to use alternate train routes, which could result in significant additional costs and network inefficiencies. Additionally, any significant consolidations, mergers, or operational changes among other railroads may alter our market access and reach.

We may be negatively affected by terrorism or war. Any terrorist attack, or other similar event, any government response thereto, and war or risk of war could cause significant business interruption or other operational challenges. Because we play a critical role in the nation’s transportation system, we could become the target of such an attack or have a significant role in the government’s preemptive approach or response to an attack or war.

Insurance coverage under Norfolk Southern's property and liability policies extends to certain acts of terrorism. In addition, premiums for some or all of our current insurance programs covering these losses could increase dramatically, or insurance coverage for certain losses could be unavailable to us in the future.

We may be negatively affected by supply constraints resulting from disruptions in our fuel markets or supplier markets. We consumed approximately 366 million gallons of diesel fuel in 2025. Fuel availability could be affected by limitation in the fuel supply or by imposition of mandatory allocation or rationing regulations. A severe fuel supply shortage arising from production curtailments, increased demand in existing or emerging foreign markets, disruption of oil imports, disruption of domestic refinery production, damage to refinery or pipeline infrastructure, political unrest, war, or other factors could impact us as well as our customers and other transportation companies.

Due to the capital-intensive nature, as well as the industry-specific requirements of the rail industry, high barriers of entry exist for potential new suppliers of core railroad items, such as locomotives and rolling stock equipment. As a result, we are dependent on certain key suppliers and manufacturers of locomotive and railroad items. Disruption to one or more of our key suppliers or manufacturers, including as a result of stopped or restricted production, labor stoppage or restriction, or significant supply shortage or outage could negatively impact our operating efficiency and increase costs. Additionally, we compete with other industries for available capacity and raw materials used in

K17

the production of locomotives and certain track and rolling stock materials. Changes in the competitive landscapes of these limited supplier markets could also result in significantly increased prices or material shortages.

We may be negatively affected by energy prices. Fuel and energy costs have a significant impact on our operations. Volatility in energy prices could have a significant effect on a variety of items including, but not limited to: the economy; demand for transportation services; business related to the energy sector, including crude oil, natural gas, and coal; fuel prices; and, fuel surcharges, each of which could have a material impact on our business and results of operations. In addition, we may also experience a disruption in energy supplies as a result of new or increased regulation, as a result of war or geopolitical conflicts, weather-related events or natural disasters, or other factors beyond our control, which could have a material adverse effect on our business.

Pandemics, epidemics, or endemic diseases could further negatively impact us, our customers, our supply chain, and our operations. The magnitude and duration of a pandemic, epidemic, or endemic disease, and its impact on our customers and general economic conditions can influence the demand for our services and affect our revenues. In addition, such outbreaks could affect our operations and business continuity if a significant number of our essential employees, overall or in a key location, are unable to work from contraction of or exposure to the disease or if governmental orders prevent our employees or critical suppliers from working. To the extent such diseases adversely affect our business and financial results, they may also have the effect of heightening many of the other risks described in the risk factors included herein or may affect our operating and financial results in a manner that is not presently known to us.

Our business is capital intensive, and we must make capital decisions based upon expectations of future usage of our assets. We make significant investments in our railroad infrastructure, including railroad property, track infrastructure, locomotives, freight cars, intermodal equipment, technology, and other assets to support our network, much of which is costly and requires significant capital outlay. The amount and timing of capital investments depend on various factors, including expectations of future carload traffic. In many cases, we must make advance commitments to purchase or modify equipment prior to such equipment being needed. As a result, we must predict volume levels and other requirements and make commitments based on those projections. A significant variance in our expectations or projections could result in too much or too little equipment relative to our actual needs and volumes, thereby negatively impacting our operations or financial results.

TECHNOLOGY RISKS

A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations. To conduct business, we extensively rely on information and operational technology systems. The threat landscape is vast, with potential attacks from cybercriminals, nation-states, state-sponsored actors and others including, but not limited to, service denials, unauthorized access, compromised equipment or rolling stock, extortion, or theft of data or money. As a result, our business continuity and disaster recovery plans and activities may not be sufficient for all eventualities, resulting in the potential for a data breach or significant service or operational disruption or failure involving one or more information or operational technology systems operated by us or under control of third parties, including computer hardware, software, cloud services and transportation and communications equipment. Such failures or disruptions can adversely impact our business by, among other things, preventing intercompany communications and disrupting operations that may result in direct or indirect monetary losses, damage to equipment or property, or loss of confidence in corporate competency. Any one or more of these events could have a material adverse effect on our results of operations, financial position, or operations. Although we maintain security programs designed to protect our information and operational technology systems, we are continually targeted by threat actors attempting to access our networks and we may be unable to detect or prevent a breach of our systems or equipment or disruption to our service in the future. In addition, while we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. These potentially impactful future events could include service disruptions, unauthorized access to our systems or equipment, viruses, ransomware, and/or the compromise, acquisition, or destruction of our data. We also could be impacted by cybersecurity events targeting third parties

K18

that we rely on for business operations, including third party vendors that have access to our systems or data and third parties who provide services and are in our supply chain. Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation or government action or increased regulation, which could result in penalties, fines or judgments. In addition, our failure to comply with or adhere to privacy-related or data protection laws and regulations could result in government investigations and proceedings against us, or litigation, resulting in adverse reputational impacts, penalties, and legal liability.

Our business may be seriously harmed if we fail to develop, implement, maintain, upgrade, enhance, protect and integrate our information or operational technology systems. If we fail to develop, acquire or implement new technology, or otherwise fail to maintain, protect or integrate our information or operational technology systems, we may suffer a competitive disadvantage within the rail industry and with companies providing alternative modes of transportation service. The techniques used by cybersecurity threat actors to obtain unauthorized access, disable or degrade service or sabotage systems change frequently, as data breaches and other cybersecurity events have become increasingly commonplace. Consequently, these techniques may be difficult to detect and cybersecurity events are therefore increasingly difficult to prevent. The rapid evolution and increased adoption of emerging technologies, such as artificial intelligence and machine learning (both of which we use), may make it more difficult to anticipate cybersecurity threats and implement adequate protective countermeasures. If we fail to adequately develop or maintain our information or operational technology systems or cybersecurity infrastructure, we may become increasingly vulnerable to cybersecurity events, or other breaches or disruptions to our information or operational technology systems.

LITIGATION RISKS

We may be subject to various claims and lawsuits that could result in significant expenditures. The nature of our business exposes us to the potential for various claims and litigation related to labor and employment, personal injury, commercial disputes, freight loss and other property damage, and other matters. Job-related personal injury and occupational claims are subject to the Federal Employer’s Liability Act (FELA), which is applicable only to railroads. FELA’s fault-based tort system produces results that are unpredictable and inconsistent as compared with a no-fault worker’s compensation system. The variability inherent in this system could result in actual costs being different from the liability recorded.

A catastrophic rail accident, whether on our lines or another carrier’s, involving any or all of release of hazardous materials, freight loss, property damage, personal injury, and environmental liability could compromise critical parts of our rail network. Losses associated with such an accident involving us could exceed our insurance coverage, resulting in a material adverse effect on our financial position or liquidity. Any material changes to current litigation trends could also have a material adverse effect on our financial position or liquidity to the extent not covered by insurance.

We have obtained insurance for potential losses for third-party liability and first-party property damages; however, insurance is available from a limited number of insurers and may not continue to be available or, if available, may not be obtainable on terms acceptable to us.

We are incurring significant expenditures as a result of claims and lawsuits arising from the Incident and the related Incident Proceedings, as described in “Incident Risks” above.

HUMAN CAPITAL RISKS

Failure to attract, retain, and transition key executive officers, or skilled professional or technical employees could adversely impact our business and operations. Our success depends on our ability to attract and retain skilled employees, including key executive officers to oversee our operational, productivity, marketing, and technological initiatives, as well as a sufficient number of skilled professional and craft employees to enable us to efficiently conduct our operations. Difficulties in recruiting and retaining skilled employees, including train and

K19

engine workers, key executives, and other skilled professional and technical employees; the loss of such individuals; and/or our inability to successfully transition key executive, professional, technical, or skilled roles could each have a material adverse effect on our financial position, results of operations, and operations. The loss of one or more key employees could also result in the depletion of our institutional knowledge base and may result in our inability or increased difficulty in successfully transitioning key roles, which could materially adversely impact our business.

The vast majority of our employees belong to labor unions, and the renegotiation of labor agreements or any provisions thereof, or any strikes or work stoppages (including any entered into in connection with any such negotiations), could adversely affect our operations. Approximately 80% of our railroad employees are covered by collective bargaining agreements with various labor unions. Future national labor agreements, or renegotiation of labor agreements or provisions of labor agreements, could significantly increase our costs for health care, wages, and other benefits. In addition, if our craft employees were to engage in or threaten a strike, work stoppage, or other slowdown, including in connection with the renegotiation of any collective bargaining agreements or any provisions thereof, we could experience a significant disruption in our operations, customer base, or belief in our ability to provide consistent service, thereby adversely affecting our operations or ability to provide services.

CLIMATE CHANGE RISKS

Severe weather and disasters have caused, and could again cause, significant business interruptions and expenditures. Severe weather conditions and other natural phenomena resulting from changing weather patterns and rising sea levels or other causes, including hurricanes, floods, fires, landslides, extreme temperatures, significant precipitation, and earthquakes, have caused, and may again cause damage to our network, our workforce to be unavailable, and us to be unable to use our equipment, or otherwise cause significant interruptions to our operations. Additionally, shifts in weather patterns caused by climate change are expected to increase the frequency, severity, or duration of certain adverse weather conditions, which could cause more significant business interruptions that result in increased costs, increased liabilities, and decreased revenues. Our inability to quickly and effectively restore operations following adverse weather and disasters could materially impact our business and results of operations. To the extent such weather events or natural disasters become more frequent or severe, disruptions to our business and those of our customers and costs to repair damaged property and equipment or maintain or resume operations could increase. Furthermore, climate change may contribute to an increase in the incidence and severity of natural disasters and adverse weather conditions and reduce the availability or increase the cost of insurance for such events.

MACROECONOMIC AND MARKET RISKS

We may be negatively impacted by changes in general economic conditions. Because our business is dependent on the rail shipping needs of our customers, negative changes in domestic and global economic conditions, including reduced import and export volumes, could affect the producers and consumers of the freight we carry. Recessionary economic cycles and downturns in customers’ business cycles, especially in market segments and industries where we have a significant concentration of customers, may substantially reduce our volumes, and lead to excess capacity in the industry, resulting in pressure on rates we are able to obtain for our services. Economic conditions could also result in bankruptcies of one or more of our customers. Changes in general economic conditions are beyond our control, and it may be difficult for us to adjust our business model. We are impacted by industrial production, inflation, unemployment, and consumer spending. We have been and may in the future be, materially impacted by adverse developments in these aspects of the economy.

The state of capital markets could adversely affect our liquidity. We rely on the capital markets to provide some of our capital requirements, including the issuance of debt instruments and the sale of certain receivables. Significant instability or disruptions of the capital markets, including the credit markets, or deterioration of our financial position due to internal or external factors could restrict or eliminate our access to, and/or significantly increase the cost of, various financing sources, including bank credit facilities and issuance of corporate bonds. Instability or disruptions of the capital markets and deterioration of our financial position, alone or in combination, could also result in a reduction of our credit rating to below investment grade, which could prohibit or restrict us

K20

from accessing external sources of short- and long-term debt financing and/or significantly increase the associated costs.

None.

CYBERSECURITY RISK MANAGEMENT AND STRATEGY

Process

We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the U.S. Department of Commerce's National Institute of Standards and Technology (NIST). The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters. Based on the NIST CSF, our processes to identify, assess, manage, and govern material risks from cybersecurity threats includes the following:

Identify

We identify risks from cybersecurity threats by first developing and maintaining an understanding of those assets essential to our operation and reputation, as well as assets that could provide value to threat actors. Any cyber act is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or its value.

Assess

We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or realize its value, or a threat actor’s ability to gain access to an asset or its value. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation.

Manage

We mitigate risks from cybersecurity threats by applying multiple layers of defense to ensure we have the continued ability to access or utilize an asset or its value, and deny threat actors the ability to gain or increase their access to an asset or its value. We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.

Govern

We govern cybersecurity risk by establishing and maintaining the policies, processes, and oversight mechanisms that define how risk is identified, assessed, and managed across the enterprise. Governance ensures that roles, responsibilities, and decision-making authority are clearly articulated and aligned with organizational objectives, regulatory requirements, and risk appetite. Through governance, we embed accountability and transparency into our cybersecurity program, enabling informed prioritization of resources and consistent execution of risk management practices.

We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.

K21

Integration into our Risk Management Framework

Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework. Technology is one of the five primary risk categories addressed by the ERM framework, and cybersecurity is identified as a subcategory of the technology risk. Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Chief Information Security Officer (CISO), and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF. Our internal ERM leadership meets regularly with our technology leadership team to review developments in our technology risk profile and works with the cybersecurity team to monitor key risk indicators linked to our cybersecurity risks. Any changes to the threat landscape are discussed and considered as adjustments to our risk profile.

Third-Party Engagement

We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Board. These reviews encompass a broad range of areas, including information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor.

Oversight of Third-Party Providers

Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including how our data is stored, accessed, and transmitted. In addition, all providers within these service categories must execute a data security addendum that articulates specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.

Risks

Please see Item 1A. Risk Factors – Technology Risks – “A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations” for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.

As noted therein, regardless of the cause, a significant disruption or failure of one or more information or operational technology systems operated by us or under control of third parties can result in service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data.

Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).

While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation, or financial results. As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and

K22

cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.

CYBERSECURITY GOVERNANCE

Board Oversight

The Norfolk Southern Board has direct oversight of cybersecurity risks. The Board receives periodic reports from the CIDO and CISO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment. Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results. Regular updates are also provided to the Board regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.

The Board receives an annual report from the CIDO and CISO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.

Management's Role

Our CISO, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Such individual has over 20 years of experience in critical infrastructure security, including significant experience working with government agencies such as the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security. As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, CISO, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.

Management and Board Reporting

Cybersecurity incidents are reported directly to the CISO in accordance with the applicable incident response plan. The CISO, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our Chief Executive Officer (CEO), and our Chief Legal Officer, who in turn notify the Chair of the Board. The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the CIDO and CISO providing the Board with further updates regarding root causes and remediation efforts.

We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the CISO and DPO and comprised of other members of management. This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.

In an effort to deter and detect cyber threats, we also periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use, and mobile security and further educates employees on the importance of and process for reporting all potential incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.

K23

For information on our legal proceedings, see Note 19 “Commitments and Contingencies” in Item 8 “Notes to Consolidated Financial Statements.”

Not applicable.

K24

Information About Our Executive Officers

Our executive officers generally are elected and designated annually by the Board at its first meeting held after the annual meeting of stockholders, and they hold office until their successors are elected. Executive officers also may be elected and designated throughout the year as the Board considers appropriate. There are no family relationships among our officers, nor any arrangement or understanding between any officer and any other person pursuant to which the officer was selected. The following table sets forth certain information, at February 1, 2026, relating to our officers.

K25

PART II

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

STOCK INFORMATION

Common Stock is owned by 17,030 stockholders of record as of December 31, 2025, and is traded on the New York Stock Exchange under the symbol “NSC.”

ISSUER PURCHASES OF EQUITY SECURITIES

(1)On March 29, 2022, our Board of Directors authorized a new program for the repurchase of up to $10.0 billion of Common Stock beginning April 1, 2022. As of December 31, 2025, $6.3 billion remains authorized for repurchase, until such amount is exhausted. With limited exceptions, the Merger Agreement prohibits repurchases of our Common Stock without Union Pacific’s consent. As a result, we suspended repurchases upon entering into the Merger Agreement.

K26

The following discussion and analysis should be read in conjunction with the Consolidated Financial Statements and Notes. Refer to Item 8 “Notes to Consolidated Financial Statements” for all “Note” references.

OVERVIEW

Since 1827, Norfolk Southern Corporation and its predecessor companies have safely moved the goods and materials that drive the U.S. economy. Our dedicated team members deliver a wide variety of commodities annually for our customers, from agriculture products to consumer goods, and help them reduce carbon emissions by shipping via rail. We have the most extensive intermodal network in the eastern U.S. Our network serves a majority of the country's population and manufacturing base, with connections to every major container port on the Atlantic coast as well as major ports in the Gulf Coast and Great Lakes.

Throughout 2025, we took deliberate actions to strengthen the Company and position it for long-term success. On July 28, 2025, we entered into a Merger Agreement with Union Pacific, marking a transformational step toward creating America’s first transcontinental railroad—an outcome we believe will unlock new opportunities for our customers, employees, and the broader U.S. economy. By integrating two complementary networks, the merged company will be positioned to deliver more efficient, reliable, and sustainable freight service across the nation. Details of the proposed transactions are further described in Note 2.

We also continued to make progress towards resolving environmental and legal matters resulting from the Incident (as defined further and described in Note 19) with insurance and other recoveries during 2025 exceeding incremental expenses. Safety continued to be a core value, and our relentless focus and intentional actions drove improvements in numerous safety metrics. Operational execution remained a key focus in 2025, with an emphasis on delivering high quality service while delivering notable improvements in labor productivity and fuel efficiency. Despite periods of macroeconomic uncertainty, growth in automotive and chemicals traffic, reflecting improved service and customer demand, drove merchandise revenues higher and led to a modest increase in overall volumes.

The combination of operational productivity, modest volume growth and favorable merchandise pricing were pivotal in driving earnings growth as compared to 2024. Although our financial results, as compared to the prior year, were significantly impacted by the absence of $433 million in gains on the sales of railway lines that occurred in 2024, we successfully monetized other properties that resulted in meaningful gains in the current year. For the full year, we achieved an operating ratio (a measure of the amount of operating revenues consumed by operating expenses) of 64.2%, and an adjusted operating ratio of 65.0% (see our non-GAAP reconciliations beginning on page K28). We remain committed to being a safe, productive, resilient, and efficient railroad with industry-competitive margins.

SUMMARIZED RESULTS OF OPERATIONS

K27

Income from railway operations, net income, and diluted earnings per share increased in 2025 compared to 2024, the result of lower railway operating expense and higher railway operating revenues. The decrease in railway operating expense includes higher net recoveries related to the Incident in addition to lower expenses associated with restructuring activities. Partially offsetting those items were lower gains from the sales of railway lines and properties and expenses incurred in 2025 related to the proposed merger. The increase in railway operating revenues was driven by a combination of favorable traffic mix, which was partially offset by lower fuel surcharge revenue. Our railway operating ratio improved to 64.2 percent.

Income from railway operations, net income, and diluted earnings per share increased in 2024 compared to 2023, primarily a result of lower railway operating expenses. The reduction in our operating expenses included lower net expenses related to the Incident and $433 million of gains on the sale of railway lines. Railway operating revenues were slightly lower as decreased fuel surcharge revenue, an adverse mix of traffic, and decreased pricing were nearly offset by increased volumes. Our railway operating ratio improved to 66.4 percent.

The following tables adjust our 2025, 2024, and 2023 financial results as reported under U.S. Generally Accepted Accounting Principles (GAAP) financial results to exclude certain items. Adjusted 2025 financial results exclude Merger-related expenses, restructuring and other charges, and the overall impact on operating expenses resulting from costs and recoveries associated with the Incident. Adjusted 2024 financial results exclude gains on railway line sales, restructuring and other charges, costs and recoveries associated with the Incident, shareholder advisory costs, and a deferred tax adjustment. Adjusted 2023 financial results exclude the effects of the Incident. The income tax effects of these non-GAAP adjustments were calculated based on the applicable tax rates to which the non-GAAP adjustments related. We use these non-GAAP financial measures internally and believe this information provides useful supplemental information to investors to facilitate making period-to-period comparisons by excluding these items. While we believe that these non-GAAP financial measures are useful in evaluating our business, this information should be considered as supplemental in nature and is not meant to be considered in isolation from, or as a substitute for, the related financial information prepared in accordance with GAAP. In addition, these non-GAAP financial measures may not be the same as similar measures presented by other companies.

Showing the first 8K of 74K characters. Open the full section

The information required by this item is included in Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations” under the heading “Market Risks.”

K43

INDEX TO FINANCIAL STATEMENTS

K44

Report of Management

February 9, 2026

To the Stockholders

Norfolk Southern Corporation:

Management is responsible for establishing and maintaining adequate internal control over financial reporting. In order to ensure that Norfolk Southern’s internal control over financial reporting is effective, management regularly assesses such controls and did so most recently as of December 31, 2025. This assessment was based on criteria for effective internal control over financial reporting described in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, management has concluded that we maintained effective internal control over financial reporting as of December 31, 2025.

KPMG LLP, independent registered public accounting firm, has audited our financial statements and issued an opinion on our internal control over financial reporting as of December 31, 2025.

K45

Report of Independent Registered Public Accounting Firm

To the Stockholders and Board of Directors

Norfolk Southern Corporation:

Opinions on the Consolidated Financial Statements and Internal Control Over Financial Reporting

We have audited the accompanying consolidated balance sheets of Norfolk Southern Corporation and subsidiaries (the Company) as of December 31, 2025 and 2024, the related consolidated statements of income, comprehensive income, cash flows, and changes in stockholders’ equity for each of the years in the three-year period ended December 31, 2025, and the related notes and financial statement schedule of valuation and qualifying accounts as listed in Item 15(A)2 (collectively, the consolidated financial statements). We also have audited the Company’s internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2025 and 2024, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 2025, in conformity with U.S. generally accepted accounting principles. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2025 based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Basis for Opinions

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Annual Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company’s consolidated financial statements and an opinion on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was

Showing the first 8K of 166K characters. Open the full section

Not applicable.

Disclosure Controls and Procedures

Our Chief Executive Officer and Chief Financial Officer, with the assistance of management, evaluated the effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (Exchange Act)) at December 31, 2025. Based on such evaluation, our officers have concluded that, at December 31, 2025, our disclosure controls and procedures were effective to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, summarized, and reported, within the time period specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including the Chief Executive Officer and the Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Management’s Annual Report on Internal Control Over Financial Reporting

We are responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting includes those policies and procedures that pertain to our ability to record, process, summarize, and report reliable financial data. We recognize that there are inherent limitations in the effectiveness of any internal control over financial reporting, including the possibility of human error and the circumvention or overriding of internal control. Accordingly, even effective internal control over financial reporting can provide only reasonable assurance with respect to financial statement preparation. Further, because of changes in conditions, the effectiveness of internal control over financial reporting may vary over time.

Our Board of Directors, acting through its Audit Committee, is responsible for the oversight of our accounting policies, financial reporting, and internal control. The Audit Committee of our Board of Directors is comprised of outside directors who are independent of management. The independent registered public accounting firm and our internal auditors have full and unlimited access to the Audit Committee, with or without management, to discuss the adequacy of internal control over financial reporting, and any other matters which they believe should be brought to the attention of the Audit Committee.

We have issued a report of our assessment of internal control over financial reporting, and our independent registered public accounting firm has issued an opinion on our internal control over financial reporting at December 31, 2025. These reports appear in Item 8 of this report on Form 10-K.

Changes in Internal Control Over Financial Reporting

During the fourth quarter of 2025, we have not identified any changes in internal control over financial reporting that have materially affected, or are reasonably likely to materially effect, our internal control over financial reporting.

K92

Director and Officer Trading Arrangements

None of our directors or officers (as defined in Rule 16a-1(f) of the Exchange Act) adopted or terminated a contract, instruction or written plan for the purchase or sale of our securities intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) or a non-Rule 10b5-1 trading arrangement (as defined in Item 408(c) of Regulation S-K) during the fourth quarter of 2025.

Not applicable.

K93

PART III

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

In accordance with General Instruction G(3), information called for by Part III, Item 10, is incorporated herein by reference to our definitive Proxy Statement for our 2026 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A. The information regarding executive officers called for by Item 401 of Regulation S-K is included in Part I hereof beginning under “Information about our Executive Officers.”

In accordance with General Instruction G(3), information called for by Part III, Item 11, is incorporated herein by reference to our definitive Proxy Statement for our 2026 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

K94

In accordance with General Instruction G(3), information on security ownership of certain beneficial owners and management called for by Part III, Item 12, is incorporated herein by reference to our definitive Proxy Statement for our 2026 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

Equity Compensation Plan Information (at December 31, 2025)

(1)Excludes securities reflected in column (a).

(2)LTIP.

(3)Includes options, RSUs, and PSUs granted under LTIP that will be settled in shares of Common Stock.

(4)TSOP.

(5)Calculated without regard to 656,199 outstanding RSUs and PSUs at December 31, 2025.

(6)Reflects shares remaining available for grant under TSOP.

Norfolk Southern Corporation Long-Term Incentive Plan

Established on June 28, 1983, and approved by our stockholders at their Annual Meeting held on May 10, 1984, LTIP was adopted to promote the success of our company by providing an opportunity for non-employee Directors, officers, and other key employees to acquire a proprietary interest in Norfolk Southern Corporation (the Corporation). The Board of Directors amended LTIP on January 23, 2015, which amendment was approved by shareholders on May 14, 2015, to include the reservation for issuance of an additional 8,000,000 shares of authorized but unissued Common Stock.

The amended LTIP adopted a fungible share reserve ratio so that, for awards granted after May 13, 2010, the number of shares remaining for issuance under the amended LTIP will be reduced (i) by 1 for each award granted as an option or stock-settled SAR, or (ii) by 1.61 for an award made in the form other than an option or stock-settled SAR. Any shares of Common Stock subject to options, PSUs, restricted shares, or RSUs which are not issued as Common Stock will again be available for award under LTIP after the expiration or forfeiture of an award.

K95

Non-employee Directors, officers, and other key employees residing in the U.S. or Canada are eligible for selection to receive LTIP awards. Under LTIP, the Committee, or the Corporation’s chief executive officer to the extent the Committee delegates award-making authority pursuant to LTIP, may grant incentive stock options, nonqualified stock options, SARs, RSUs, restricted shares, PSUs and performance shares. In addition, dividend equivalent payments may be awarded for options, RSUs and PSUs. Awards under LTIP may be made subject to forfeiture under certain circumstances and the Committee may establish such other terms and conditions for the awards as provided in LTIP.

The option price is at least the higher of (i) the average of the high and low prices at which Common Stock is traded on the date of grant, or (ii) the closing price of Common Stock on the date of the grant. All options are subject to a vesting period of at least one year, and the term of the option will not exceed ten years. LTIP specifically prohibits option repricing without stockholder approval, except that adjustments may be made in the event of changes in our capital structure or Common Stock.

PSUs entitle a recipient to receive performance-based compensation at the end of a three-year cycle based on our performance during that period. For the 2025 PSU awards, corporate performance will be based directly on both return on average capital invested and total return to stockholders and will be settled in shares of Common Stock.

RSUs are payable in cash or in shares of Common Stock at the end of a restriction period. During the restriction period, the holder of the RSUs has no beneficial ownership interest in the Common Stock represented by the RSUs and has no right to vote the shares represented by the units or to receive dividends (except for dividend equivalent payment rights that may be awarded with respect to the RSUs). The Committee at its discretion may waive the restriction period, but settlement of any RSUs will occur on the same settlement date as would have applied absent a waiver of restrictions, if no performance goals were imposed. RSUs will be settled in shares of Common Stock.

Norfolk Southern Corporation Thoroughbred Stock Option Plan

Our Board of Directors adopted TSOP on January 26, 1999, to promote the success of our company by providing an opportunity for management employees to acquire a proprietary interest in our company and thereby to provide an additional incentive to management employees to devote their maximum efforts and skills to the advancement, betterment, and prosperity of our company and our stockholders. Under TSOP there were 6,000,000 shares of authorized but unissued Common Stock reserved for issuance. TSOP has not been and is not required to have been approved by our stockholders.

Active full-time management employees residing in the U.S. or Canada are eligible for selection to receive TSOP awards. Under TSOP, the Committee, or the Corporation’s chief executive officer to the extent the Committee delegates award-making authority pursuant to TSOP, may grant nonqualified stock options subject to such terms and conditions as provided in TSOP.

The option price may not be less than the average of the high and low prices at which Common Stock is traded on the date of the grant. All options are subject to a vesting period of at least one year, and the term of the option will not exceed ten years. TSOP specifically prohibits repricing without stockholder approval, except for capital adjustments.

K96

Norfolk Southern Corporation Directors’ Restricted Stock Plan

The Plan was adopted on January 1, 1994, and was designed to increase ownership of Common Stock by our non-employee Directors so as to further align their ownership interest in our company with that of our stockholders. The Plan has not been and is not required to have been approved by our stockholders.

Effective January 23, 2015, the Board amended the Plan to provide that no additional awards will be made under the Plan. Prior to that amendment, only non-employee Directors who are not and never have been employees of our company were eligible to participate in the Plan. Upon becoming a Director, each eligible Director received a one-time grant of 3,000 restricted shares of Common Stock. No additional shares may be granted under the Plan. No individual member of the Board exercised discretion concerning the eligibility of any Director or the number of shares granted.

The restriction period applicable to restricted shares granted under the Plan begins on the date of the grant and ends on the earlier of the recipient’s death or the day after the recipient ceases to be a Director by reason of disability or retirement. During the restriction period, shares may not be sold, pledged, or otherwise encumbered. Directors forfeit the restricted shares if they cease to serve as a Director of our company for reasons other than their disability, retirement, or death.

In accordance with General Instruction G(3), information called for by Part III, Item 13, is incorporated herein by reference to our definitive Proxy Statement for our 2026 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

Our independent registered public accounting firm is KPMG LLP, Atlanta, GA, Auditor Firm ID: 185.

In accordance with General Instruction G(3), information called for by Part III, Item 14, is incorporated herein by reference to our definitive Proxy Statement for our 2026 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

K97

PART IV

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

K98

K99

K100

K101

K102

K103

K104

K105