GasLog Partners LP

Risk Management and Strategy

The Partnership relies on information technology systems and networks, the majority of which are hosted by GasLog, in its operations and the administration of its business. The Partnership’s business operations, or those of GasLog, could be targeted by individuals or groups seeking to sabotage or disrupt the Partnership’s or GasLog’s information and operational technology systems and networks, or to steal data. The Partnership’s cybersecurity risk management and governance largely relies on GasLog’s resources.

GasLog has in place safety and security measures on our vessels and onshore operations to secure our vessels against cybersecurity incidents. GasLog’s processes for assessing, identifying and managing material risks from cybersecurity threats include:

GasLog also has processes to oversee and identify cybersecurity risks from cybersecurity threats associated with our use of suppliers, vendors, third-party service providers and IT support companies. These include the use of cybersecurity questionnaires, the performance of contract reviews to ensure IT-related compliance and the mitigation of identified information security risks and the sharing of our information security and acceptable use policy.

GasLog uses external cybersecurity experts in connection with cybersecurity threat detection and collection of cyber threat intelligence to help us conduct internal training such as unannounced cybersecurity drills and to assist with the management and post-incident analysis of incidents.

GasLog has adopted the internal policies mentioned above to implement reporting procedures for any cybersecurity incident and a cybersecurity management framework to continuously monitor and access risk. These policies are developed and periodically reviewed by GasLog’s IT steering committee. The processes outlined above have also been integrated into our overall risk management strategy.

For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see “Item 3. Key Information—D. Risk Factors—Risks related to Us—We rely on our information systems to conduct our business and failure to protect these systems against security breaches could materially disrupt our business and adversely affect our results of operations,” which is incorporated by reference into this Item 16K.

Governance

The Audit Committee has ultimate responsibility for the oversight of cybersecurity risks and responses to cybersecurity incidents, should they arise. The Audit Committee receives quarterly updates about cybersecurity threats and processes from the CEO.

The key management body responsible for accessing and managing material risks from cybersecurity threats is GasLog’s IT steering committee which is made up of the CEO, the COO, the CFO, the Head of Information, Communication and Technology

(“ICT”) and the Business Process Innovation Manager of GasLog. The IT steering committee periodically extends invitations to additional participants.

The IT steering committee receives information from the Head of ICT regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents logged by the ICT department, GasLog’s Duty Officer and the Cybersecurity Incident Response Team (“CSIRT”). The Cyber Security Officer (“CySO”) is responsible for researching, developing, implementing, testing and reviewing our information security to protect information and prevent unauthorized access. GasLog’s procedures provide that, to the extent any cybersecurity incident occurs, the Head of ICT or the CySO is the immediate contact. The CSIRT and IT steering committee then take follow-up actions including reporting the incident to relevant stakeholders, carrying out a post-incident review and updating key information, controls and processes. The CEO, who supervises the IT steering committee, then reports to the Audit Committee, as discussed above, which assesses, with the support of the legal team, the materiality of incidents in the context of the Company’s reporting and disclosure obligations.