The Companies have identified cybersecurity as a key enterprise risk. As operators of critical energy infrastructure, the Companies require the continuous operation of information systems and network infrastructure. Cybersecurity threats are assessed, identified and managed as part of the Companies’ corporate-wide Enterprise Risk Management (ERM) program. The ERM program establishes processes to identify emerging issues; monitor, assess and mitigate known risks; align risk exposure to organizational priorities; and inform business decisions and resource allocation. In accordance with the Companies’ ERM program, management has established a multidisciplinary cybersecurity team including personnel from the technology, operations, legal, compliance, and risk management departments that identifies, assesses and remediates cybersecurity risks.
The Companies employ several processes to manage their cybersecurity risks, including, but not limited to, the following:
- Incident Detection and Prevention: The Companies deploy safeguards designed to protect their operational and information systems, the personal information of their customers and employees and other critical information from cybersecurity threats. These safeguards include, among other things, intrusion prevention and detection systems, anti-malware functionality and ongoing vulnerability assessments.
- Review and Assessment: The Companies assess the severity, likelihood and controllability of cybersecurity threats and consider risk outlook, recent external and internal cybersecurity events and audit findings to assess their overall cybersecurity risk management process. The Companies then use the findings from these assessments to inform cybersecurity risk mitigation activities, including long-term strategic and short-term tactical efforts, and capital allocation decisions.
- Independent Advisors: The Companies engage consultants to assess, identify and manage material risks from cybersecurity threats on a regular basis. The consultants are engaged to, among other things, assess the process by which cybersecurity threats are identified; provide incident response and forensic services; review and analyze cybersecurity controls and infrastructure; and provide threat emulation services.
- Third-Party Risk Assessments: The Companies’ vendors and suppliers participate in a third-party risk assessment to periodically validate such party’s profile across multiple risk domains. A cybersecurity risk assessment is performed by the Companies’ Information Technology department to assess the controls of high-risk third parties that, among other things, possess the Companies’ sensitive information and the personal information of their customers and employees.
- Disclosure Controls and Procedures: Management has developed protocols and procedures to share information regarding cybersecurity incidents with the Chief Information Security Officer, Chief Privacy Officer, the Companies’ Disclosure Committee and the Law Department to enable assessments related to disclosure and reporting obligations in compliance with federal and state cybersecurity and data privacy regulations.
- Incident Response: The Companies have established and maintain incident response plans that set forth procedures for their response to cybersecurity incidents and data breaches and test and evaluate such plans on an ongoing basis.
- Training and Compliance: The Companies train employees regularly on potential cybersecurity threats; perform drills; monitor network and computing systems; collaborate with government and industry partners on threat mitigation; and also collaborate with local, state and federal agencies and utility industry colleagues to identify and employ tools that seek to protect the Companies’ operational and information systems and the personal information of their customers and employees from cybersecurity threats.
The Companies have experienced cybersecurity incidents and attacks in the past and expect to experience them in the future. None of the incidents or attacks that the Companies experienced have had a material impact on the Companies’ business strategy, results of operations or financial condition. Although the Companies have established processes to assess, identify and manage cybersecurity risks, such processes do not provide absolute assurance against a cybersecurity attack that could materially impact the Companies. In the event of a cybersecurity incident or attack that the Companies were unable to defend against or mitigate, the Companies’ business strategy, results of operations or financial condition are reasonably likely to be materially affected. Such an incident could disrupt the Companies’ or their customers’ operations, cause damage to the Companies’ properties, financial and other information systems and network infrastructure and could result in the theft of the Companies’, their employees’ or customers’ information. See “A Cyber Attack Could Adversely Affect the Companies” in Item 1A.