Amplify Energy Corp.

Our cybersecurity strategy is risk-based and is designed to reduce the likelihood and impact of cyber threats through prevention, detection, analysis, response, and resiliency. Our risk management processes include technical controls, policy enforcement mechanisms, continuous monitoring, contractual arrangements, use of third-party tools and services, and management oversight to assess, identify, and manage risks from cybersecurity threats. We implement controls to protect Company information (including the information of our customers and other third parties), our information systems, our business operations, and our products and services. However, our financial, accounting, data processing, portfolio monitoring, backup or other operating systems and facilities may fail to operate properly or become disabled or damaged as a result of a number of factors including events that are wholly or partially beyond our control.

We have adopted security control principles primarily based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and, where applicable to our operational technology (OT) environment, ISA/IEC 62443. We also leverage industry and government associations, third party benchmarking, internal and external Company audit results, threat intelligence feeds, and similar resources to inform our cybersecurity processes and resource allocation. We consume threat intelligence from multiple vendors including our cyber insurance partners and integrate those insights into our monitoring, detection, and response workflows.

Our information security program includes physical, administrative, and technical safeguards, and plans and procedures designed to help us timely and effectively respond to cybersecurity threats or incidents, including those involving third-party service providers that have access to our systems or data or that support critical business operations. Despite our implementation of a variety of security measures, our computer systems, networks, and data, like those of other companies, could be subject to cybersecurity threats or incidents. Cybersecurity threats or incidents are considered to be any adverse event that threatens the confidentiality, integrity or availability of the information resources of us or our portfolio companies. The result of these cybersecurity threats or incidents may include disrupted operations, including the ability to make distributions, misstated or unreliable financial data, failure to maintain the security, confidentiality or privacy of sensitive data, including personal information relating to investors (and the beneficial owners of investors), liability for stolen assets or information, regulatory penalties, increased cyber security protection and insurance costs, litigation and damage to business relationships, reputational damage, and increased costs associated with mitigation of damages and remediation. Through our cybersecurity risk management process overseen by the Amplify Information Technology Steering Committee (the “Steering Committee”) we continuously monitor vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of cyber threats and of the countermeasures we implement to defend against them. This process is integrated into the Company’s overall Risk Management Program, and our Cyber Incident Response planning is integrated into our Business Continuity Program. In addition, we engage independent third-party consultants on a routine basis to assess, enhance, implement, and monitor our cybersecurity risk management program and to support incident response.

We conduct regular Company-wide awareness activities, including monthly cybersecurity training and weekly phishing simulations, and we run tabletop exercises and targeted, role-based modules for higher risk users. The results of these activities, along with key risk indicators and program metrics, are reviewed by management and shared with oversight bodies.

Our Steering Committee was established to further strengthen our cybersecurity risk management activities across the Company, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The Steering Committee has primary management oversight responsibility for assessing and managing risks from cybersecurity threats and is responsible for developing and coordinating enterprise cybersecurity policies and strategies and for providing guidance to key management and oversight bodies. Our Vice President of Information Technology, who has nearly two decades of information technology and cybersecurity risk management experience, serves as the chair of the Steering Committee. The Steering Committee includes senior executives and managers, with significant risk management expertise, from multiple areas of the business. The Steering Committee meets quarterly and reports tosenior management regarding the progress of specific cybersecurity objectives. Cross-enterprise action teams will be formed, as needed, to manage and implement key decisions of the Steering Committee. A strong partnership exists between our information technology, finance, operations, internal audit, and legal departments for the purpose of addressing identified issues in a timely manner and reporting incidents as required.

The Nominating & Governance Committee, which is comprised entirely of independent directors, has primary responsibility for oversight of our initiatives, policies, and performance regarding risk management matters, including information security, cybersecurity, business continuity, and data protection and privacy. The Committee generally meets at least quarterly and, together with members of senior management, reviews assessments of cyber risks, the threat landscape, and our risk mitigation and governance strategies. The Nominating & Governance Committee and senior management brief the full board of directors of the Company, as appropriate, on cybersecurity matters discussed during committee meetings.

Management has established processes to assess the materiality of cybersecurity incidents, considering operational, financial, legal/regulatory, and reputational impacts, and to determine whether a series of otherwise immaterial incidents is material in the aggregate. These processes support timely disclosure and reporting under applicable SEC rules.

While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely tomaterially affect us. Similarly, we intend to periodically evaluate and/or adjust internal policies governing our use of artificial intelligence technologies and our compliance with applicable data privacy laws and regulations. However, we face certain ongoing risks from cybersecurity threats, that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations, and/or financial condition. For more information about these risks, see the risk factor titled, “Our business could be negatively affected by security threats, including cybersecurity threats, destructive forms of protest and opposition by activists and other disruptions” under Item 1A of Part I of this Annual Report.