Edison International and SCE systems are targets for physical and cyber attacks. Regulators such as NERC and U.S. Government agencies, including the Departments of Defense, Homeland Security, and Energy, have increasingly stressed that threat sources continue to seek to identify and exploit vulnerabilities in the U.S. national electric grid and other critical energy infrastructures, and that such attacks and disruptions, both physical and cyber, are highly sophisticated and dynamic. Several U.S. Government agencies have highlighted the increasing risks related to physical and cybersecurity attacks, including ransomware attacks, related to the electric sector, including its supply chain, and that the risks may escalate during periods of heightened geopolitical tensions.
SCE requires the uninterrupted use of sophisticated information and operational technology systems and infrastructure to monitor and operate the electric grid. In the regular course of SCE’s business, it also handles a range of sensitive infrastructure, security, employee, customer, and business systems information. If SCE's information technology and operational technology systems' security were to be compromised by physical or electronic means or a critical system or technology failure were to occur without timely recovery, including failure of new technology to be implemented as designed, SCE could be unable to fulfill critical business functions and/or sensitive information could be misappropriated or compromised. Such events could result in violations of privacy and other laws, material financial loss to SCE and/or to its customers, loss of confidence in SCE's security risk management, customer dissatisfaction, and significant litigation and/or regulatory exposure, all of which could materially affect Edison International’s and SCE's financial condition, operations, and the business reputation of Edison International and SCE.