UGI CORP /PA/

The Audit Committee is responsible for reviewing periodically the effectiveness of the Company's information and technology security policies and the internal controls regarding information and technology security and cybersecurity. We also have several working groups responsible for collaborating on cybersecurity policies and standards. The Global Chief Information Officer and the Global Chief Information Security Officer report to the Audit Committee quarterly on the Company’s cybersecurity program, and to the Board of Directors, as necessary. In the event of a cybersecurity incident, our Global Chief Information Officer and Global Chief Information Security Officer, and others serving in similar capacities, will assess the incident and activate an incident response plan. These officers will escalate review of the incident to business unit leaders and/or members of our executive leadership team, as appropriate. We have a cybersecurity program to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company. Our cybersecurity program has a formalized framework that is informed by domestic and international laws, regulations and industry best practices and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to safeguard the confidentiality, integrity and availability of our information and systems. Our Information Security Program serves as the foundation of our cybersecurity program and our Acceptable Use Policy and Information Security Program Policy also provides governance in this area. We partner with other companies, industries and law enforcement to communicate information about the latest cybersecurity threats and leverage threat modeling insights. We conduct cybersecurity assessments against industry cybersecurity frameworks to better enable us to prioritize actions and investments to enhance our cybersecurity capabilities. Our cybersecurity teams work diligently to safeguard Company and customer data by applying layered and defensive mechanisms to proactively provide the security needed to detect and defend against cyber-attacks and to withstand potential impacts. We periodically conduct tabletop exercises and penetration testing to test our defenses. In addition, we provide new hires and employees with cybersecurity training, which is monitored and tracked on an annual basis. We also issue routine phishing campaigns to educate employees on social engineering techniques and informal security awareness exercises are conducted throughout the year.