Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: •Ongoing Assessment—Cybersecurity, led by the VP, Chief Information Security Officer (CISO), reporting to the SVP, Chief Information and Digital Officer (CIDO), is staffed…
Read full text
Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: •Ongoing Assessment—Cybersecurity, led by the VP, Chief Information Security Officer (CISO), reporting to the SVP, Chief Information and Digital Officer (CIDO), is staffed with cyber professionals who assess material risks from cybersecurity threats. In addition, the Cybersecurity Council, comprised of senior management, is kept apprised of PSEG’s cybersecurity program, including any emerging risks, and provides guidance on the strategic direction of the program. Ongoing Assessment—Cybersecurity, led by the VP, Chief Information Security Officer (CISO), reporting to the SVP, Chief Information and Digital Officer (CIDO), is staffed with cyber professionals who assess material risks from cybersecurity threats. In addition, the Cybersecurity Council, comprised of senior management, is kept apprised of PSEG’s cybersecurity program, including any emerging risks, and provides guidance on the strategic direction of the program. •Engagement of Nth Parties—We engage Nth parties (third parties and other business relationships, including fourth parties, etc.), such as cybersecurity service providers, risk management firms, and external legal counsel, to assess Engagement of Nth Parties—We engage Nth parties (third parties and other business relationships, including fourth parties, etc.), such as cybersecurity service providers, risk management firms, and external legal counsel, to assess engage 33 33 Table of Contents Table of Contents Table of Contents material risks from cybersecurity threats, assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including, but not limited to, the NRC, Transportation Security Administration (TSA), and NERC, inspect applicable components of our cybersecurity program.•Nth-Party Service Provider Management—We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers, including a risk-based vendor management program, which incorporates cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits.•Technical Safeguards—We manage controls to protect our network perimeter, internal IT, and Operational Technology (OT) environments, including internal and external firewalls, network intrusion detection and prevention tools, penetration testing, vulnerability assessments, threat intelligence, endpoint security, and access controls.•Training and Awareness—We provide mandatory annual cybersecurity training to all personnel with network access, and additional education to personnel with access to industrial control systems and/or customer information systems. We conduct phishing exercises with progressive consequences for failures. We also share periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, we host presentations from internal and external cyber experts on diverse cyber topics. These efforts better enable those with network access to identify potential cybersecurity risks and escalate them appropriately.•Incident Response Plans—We maintain and periodically update a cyber incident response plan that covers technical (i.e., detection, response, and recovery) and collaborative (i.e. external communication/disclosure and legal compliance) aspects of cyber incident and breach response; and conduct tabletop exercises to test plan effectiveness (both internally and through external exercises).•Mobile Security—We maintain controls to prevent loss of data through mobile devices. •Artificial Intelligence Security—We maintain AI governance, including policies and a council, incorporating AI into our Nth Party Risk Assessment process, and implementing technical controls that enable people to use AI to complete tasks more efficiently and our cyber team to better combat more sophisticated threats that make use of AI.•Physical Security—We maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (e.g. fencing, walls, and bollards). Additional features of PSEG’s physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG’s critical facilities. These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO’s other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents.Governance–PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: •PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG’s risk management program and reviewing the most significant risks facing PSEG, including material risks from cybersecurity threats, assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including, but not limited to, the NRC, Transportation Security Administration (TSA), and NERC, inspect applicable components of our cybersecurity program.•Nth-Party Service Provider Management—We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers, including a risk-based vendor management program, which incorporates cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits.•Technical Safeguards—We manage controls to protect our network perimeter, internal IT, and Operational Technology (OT) environments, including internal and external firewalls, network intrusion detection and prevention tools, penetration testing, vulnerability assessments, threat intelligence, endpoint security, and access controls.•Training and Awareness—We provide mandatory annual cybersecurity training to all personnel with network access, and additional education to personnel with access to industrial control systems and/or customer information systems. We conduct phishing exercises with progressive consequences for failures. We also share periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, we host presentations from internal and external cyber experts on diverse cyber topics. These efforts better enable those with network access to identify potential cybersecurity risks and escalate them appropriately.•Incident Response Plans—We maintain and periodically update a cyber incident response plan that covers technical (i.e., detection, response, and recovery) and collaborative (i.e. external communication/disclosure and legal compliance) aspects of cyber incident and breach response; and conduct tabletop exercises to test plan effectiveness (both internally and through external exercises).•Mobile Security—We maintain controls to prevent loss of data through mobile devices. •Artificial Intelligence Security—We maintain AI governance, including policies and a council, incorporating AI into our Nth Party Risk Assessment process, and implementing technical controls that enable people to use AI to complete tasks more efficiently and our cyber team to better combat more sophisticated threats that make use of AI.•Physical Security—We maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (e.g. fencing, walls, and bollards). Additional features of PSEG’s physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG’s critical facilities. These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO’s other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents. material risks from cybersecurity threats, assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including, but not limited to, the NRC, Transportation Security Administration (TSA), and NERC, inspect applicable components of our cybersecurity program. material risks from cybersecurity threats, assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including, but not limited to, the NRC, Transportation Security Administration (TSA), and NERC, inspect applicable components of our cybersecurity program. •Nth-Party Service Provider Management—We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers, including a risk-based vendor management program, which incorporates cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits. Nth-Party Service Provider Management—We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers, including a risk-based vendor management program, which incorporates cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits. We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers •Technical Safeguards—We manage controls to protect our network perimeter, internal IT, and Operational Technology (OT) environments, including internal and external firewalls, network intrusion detection and prevention tools, penetration testing, vulnerability assessments, threat intelligence, endpoint security, and access controls. Technical Safeguards—We manage controls to protect our network perimeter, internal IT, and Operational Technology (OT) environments, including internal and external firewalls, network intrusion detection and prevention tools, penetration testing, vulnerability assessments, threat intelligence, endpoint security, and access controls. •Training and Awareness—We provide mandatory annual cybersecurity training to all personnel with network access, and additional education to personnel with access to industrial control systems and/or customer information systems. We conduct phishing exercises with progressive consequences for failures. We also share periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, we host presentations from internal and external cyber experts on diverse cyber topics. These efforts better enable those with network access to identify potential cybersecurity risks and escalate them appropriately. Training and Awareness—We provide mandatory annual cybersecurity training to all personnel with network access, and additional education to personnel with access to industrial control systems and/or customer information systems. We conduct phishing exercises with progressive consequences for failures. We also share periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, we host presentations from internal and external cyber experts on diverse cyber topics. These efforts better enable those with network access to identify potential cybersecurity risks and escalate them appropriately. •Incident Response Plans—We maintain and periodically update a cyber incident response plan that covers technical (i.e., detection, response, and recovery) and collaborative (i.e. external communication/disclosure and legal compliance) aspects of cyber incident and breach response; and conduct tabletop exercises to test plan effectiveness (both internally and through external exercises). Incident Response Plans—We maintain and periodically update a cyber incident response plan that covers technical (i.e., detection, response, and recovery) and collaborative (i.e. external communication/disclosure and legal compliance) aspects of cyber incident and breach response; and conduct tabletop exercises to test plan effectiveness (both internally and through external exercises). •Mobile Security—We maintain controls to prevent loss of data through mobile devices. Mobile Security—We maintain controls to prevent loss of data through mobile devices. •Artificial Intelligence Security—We maintain AI governance, including policies and a council, incorporating AI into our Nth Party Risk Assessment process, and implementing technical controls that enable people to use AI to complete tasks more efficiently and our cyber team to better combat more sophisticated threats that make use of AI. Artificial Intelligence Security—We maintain AI governance, including policies and a council, incorporating AI into our Nth Party Risk Assessment process, and implementing technical controls that enable people to use AI to complete tasks more efficiently and our cyber team to better combat more sophisticated threats that make use of AI. •Physical Security—We maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (e.g. fencing, walls, and bollards). Additional features of PSEG’s physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG’s critical facilities. Physical Security—We maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (e.g. fencing, walls, and bollards). Additional features of PSEG’s physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG’s critical facilities. These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO’s other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents. These processes are integral integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. material Governance–PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: •PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG’s risk management program and reviewing the most significant risks facing PSEG, including Governance –PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: •PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG’s risk management program and reviewing the most significant risks facing PSEG, including •PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG’s risk management program and reviewing the most significant risks facing PSEG, including PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG’s risk management program and reviewing the most significant risks facing PSEG, including 34 34 Table of Contents Table of Contents Table of Contents cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risks are mapped primarily to the Board’s Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG’s Cybersecurity Incident Response Plan, as administered by the CISO.•IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, for overseeing PSEG’s cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed of cybersecurity risks by the CIDO and/or the CISO, during the IOC’s four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place.•Audit Committee—The Audit Committee is responsible for overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives an annual cybersecurity update from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have an invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. •Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity. •Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC, and Audit Committee are informed of cybersecurity risks through frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate. –Management’s Role in Assessing and Managing Material Cybersecurity Risks:The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below. •CIDO—The CIDO has had the overall responsibility for PSEG’s cybersecurity since September 2022, including the assessment and management of material risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report to the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO’s experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality. As noted above, the CIDO regularly attends and provides updates with the CISO to the IOC. cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risks are mapped primarily to the Board’s Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG’s Cybersecurity Incident Response Plan, as administered by the CISO.•IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, for overseeing PSEG’s cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed of cybersecurity risks by the CIDO and/or the CISO, during the IOC’s four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place.•Audit Committee—The Audit Committee is responsible for overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives an annual cybersecurity update from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have an invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. •Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity. •Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC, and Audit Committee are informed of cybersecurity risks through frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate. cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risks are mapped primarily to the Board’s Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG’s Cybersecurity Incident Response Plan, as administered by the CISO. cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risks are mapped primarily to the Board’s Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG’s Cybersecurity Incident Response Plan, as administered by the CISO. cybersecurity ri sks. •IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, for overseeing PSEG’s cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed of cybersecurity risks by the CIDO and/or the CISO, during the IOC’s four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, for overseeing PSEG’s cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed of cybersecurity risks by the CIDO and/or the CISO, during the IOC’s four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. IOC —At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, for overseeing PSEG’s cybersecurity program and assessing overall compliance through active, independent and critical oversight. •Audit Committee—The Audit Committee is responsible for overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives an annual cybersecurity update from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have an invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. Audit Committee—The Audit Committee is responsible for overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives an annual cybersecurity update from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have an invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above.