Risk Management and Strategy

The Partnership relies on information technology systems and networks, the majority of which are hosted by GasLog, in its operations and the administration of its business. The Partnership’s business operations, or those of GasLog, could be targeted by individuals or groups seeking to sabotage or disrupt the Partnership’s or GasLog’s information and operational technology systems and networks, or to steal data. The Partnership’s cybersecurity risk management and governance largely relies on GasLog’s resources.

GasLog has in place safety and security measures on our vessels and onshore operations to secure our vessels against cybersecurity incidents. GasLog’s processes for assessing, identifying and managing material risks from cybersecurity threats include:

GasLog also has processes to oversee and identify cybersecurity risks from cybersecurity threats associated with our use of suppliers, vendors, third-party service providers and IT support companies. These include the use of cybersecurity questionnaires, the performance of contract reviews to ensure IT-related compliance and the mitigation of identified information security risks and the sharing of our information security and acceptable use policy.

GasLog uses external cybersecurity experts in connection with cybersecurity threat detection and collection of cyber threat intelligence to help us conduct internal training such as unannounced cybersecurity drills and to assist with the management and post-incident analysis of incidents.

GasLog has adopted the internal policies mentioned above to implement reporting procedures for any cybersecurity incident and a cybersecurity management framework to continuously monitor and access risk. These policies are developed and periodically reviewed by GasLog’s IT steering committee. The processes outlined above have also been integrated into our overall risk management strategy.

For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see “Item 3. Key Information—D. Risk Factors—Risks related to Us—We rely on our information systems to conduct our business and failure to protect these systems against security breaches could materially disrupt our business and adversely affect our results of operations,” which is incorporated by reference into this Item 16K.

GasLog has in place safety and security measures on our vessels and onshore operations to secure our vessels against cybersecurity incidents. GasLog’s processes for assessing, identifying and managing material risks from cybersecurity threats include:

GasLog also has processes to oversee and identify cybersecurity risks from cybersecurity threats associated with our use of suppliers, vendors, third-party service providers and IT support companies. These include the use of cybersecurity questionnaires, the performance of contract reviews to ensure IT-related compliance and the mitigation of identified information security risks and the sharing of our information security and acceptable use policy.

GasLog uses external cybersecurity experts in connection with cybersecurity threat detection and collection of cyber threat intelligence to help us conduct internal training such as unannounced cybersecurity drills and to assist with the management and post-incident analysis of incidents.

GasLog has adopted the internal policies mentioned above to implement reporting procedures for any cybersecurity incident and a cybersecurity management framework to continuously monitor and access risk. These policies are developed and periodically reviewed by GasLog’s IT steering committee. The processes outlined above have also been integrated into our overall risk management strategy.

We rely on our information systems to conduct our business and failure to protect these systems against security breaches could materially disrupt our business and adversely affect our results of operations.

The Partnership relies on information technology systems and networks, the majority of which are hosted by GasLog, in its operations and the administration of its business. The Partnership’s business operations, or those of GasLog, could be targeted by individuals or groups seeking to sabotage or disrupt the Partnership’s or GasLog’s information and operational technology systems and networks, or to steal data. A successful cyber-attack could materially disrupt the Partnership’s operations, including the safety and integrity of its operations, or lead to unauthorized release of information or alteration of information on its systems. Any such attack or other breach of the Partnership’s information technology systems could have a material adverse effect on the Partnership’s business and results of operations. While we have insurance policies in place to cover losses in the event of a cyber related event, there can be no assurance that any specific event would be covered by these policies or that the losses would be covered in full.

War, terrorism and geopolitical conflicts could be accompanied by cyber-attacks against instruments of the government and/or cyber-attacks on surrounding countries. Cyber-attacks against the Ukrainian government and other countries in the region were reported in connection with the ongoing conflict between Russian and Ukraine in 2022. It is possible that such attacks could have collateral effects on additional critical infrastructure and financial institutions globally, which could hinder our ability to conduct our business effectively and adversely impact our revenues. It is difficult to assess the likelihood of such threat and any potential impact at this time.

We are subject to laws, directives, and regulations relating to the collection, use, retention, disclosure, security and transfer of personal data. These laws, directives and regulations, as well as their interpretation and enforcement, continue to evolve and may be inconsistent from jurisdiction to jurisdiction. For example, the EU’s General Data Protection Regulation (“GDPR”), which regulates the use of personally identifiable information, applies globally to all of our activities conducted from an establishment in the EU, to related products and services that we offer to EU customers and to non-EU customers which offer services in the EU. The GDPR requires organizations to report on data breaches within 72 hours and be bound by more stringent rules for obtaining the consent of individuals on how their data can be used. Complying with the GDPR and similar emerging and changing privacy and data protection requirements may cause us to incur substantial costs or require us to change our business practices. Non-compliance with our legal obligations relating to privacy and data protection could result in penalties, fines, legal proceedings by governmental entities or others, loss of reputation, legal claims by individuals and customers and significant legal and financial exposure and could affect our ability to retain and attract customers.

Changes in the nature of cyber threats and/or changes to industry standards and regulations might require us to adopt additional procedures for monitoring cybersecurity, which could require significant additional expenses and/or capital expenditures.

For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see “Item 3. Key Information—D. Risk Factors—Risks related to Us—We rely on our information systems to conduct our business and failure to protect these systems against security breaches could materially disrupt our business and adversely affect our results of operations,” which is incorporated by reference into this Item 16K.

The key management body responsible for accessing and managing material risks from cybersecurity threats is GasLog’s IT steering committee which is made up of the CEO, the COO, the CFO, the Head of Information, Communication and Technology (“ICT”) and the Business Process Innovation Manager of GasLog. The IT steering committee periodically extends invitations to additional participants.

The IT steering committee receives information from the Head of ICT regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents logged by the ICT department, GasLog’s Duty Officer and the Cybersecurity Incident Response Team (“CSIRT”). The Cyber Security Officer (“CySO”) is responsible for researching, developing, implementing, testing and reviewing our information security to protect information and prevent unauthorized access. GasLog’s procedures provide that, to the extent any cybersecurity incident occurs, the Head of ICT or the CySO is the immediate contact. The CSIRT and IT steering committee then take follow-up actions including reporting the incident to relevant stakeholders, carrying out a post-incident review and updating key information, controls and processes. The CEO, who supervises the IT steering committee, then reports to the Audit Committee, as discussed above, which assesses, with the support of the legal team, the materiality of incidents in the context of the Company’s reporting and disclosure obligations.

​