4 unchanged sentences
The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security.
−Removed: The Finance Committee of the Board of Trustees is responsible for oversight of the Company’s enterprise-wide risks, including risks associated with cyber and physical security, and the Company’s programs and practices to monitor and mitigate these risks.
+Added: The Finance Committee of the Board of Trustees is responsible for oversight of the Company’s enterprise-wide risk s, including risks associated with cyber and physical security, and the Company’s programs and practices to monitor and mitigate these risks.
Management prepares comprehensive cyber security reports that are discussed at each meeting of the Finance Committee.
2 unchanged sentences
The Company regularly reviews and updates its cyber and system security programs, and the Finance Committee continues to enhance its robust oversight activities, including meetings with financial, information technology, legal and accounting management, other members of the Board, representatives of the Company’s independent registered public accounting firm, and outside advisors and experts in cyber security risks, at which cyber and system security programs and issues that might affect the Company’s financial statements and operational systems are discussed.
−Removed: The Company has a robust Enterprise Risk Management Program which has identified cyber security as a top enterprise risk.
+Added: The Company has a robust Enterprise Risk Management Program that has identified cyber security as a top enterprise risk.
The managing and monitoring of risks are the responsibility of the Company’s Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer.
+Added: Members include key leaders of the Company, including the Chief Information Officer.
The Company is committed to continuous monitoring and assessment of cyber security controls.
4 unchanged sentences
The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit.
−Removed: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security or ransomware incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer:
+Added: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer:
• Implementation of security solutions and standards based on industry best practices to prevent unauthorized access.
−Removed: The Company’s cyber program has been modeled after the National Institute of Standards and Technology framework;
−Removed: a widely accepted framework utilized by critical infrastructure industries.
+Added: The Company’s cyber program has been modeled after the Department of Energy’s Cyber Capability Maturity Model and the National Institute of Standards and Technology framework;
+Added: both widely accepted frameworks utilized by utilities and other critical infrastructure industries.
• Periodic external assessments, including outside system access testing, are performed.
4 unchanged sentences
government and industry organizations, to be able to identify and respond to emerging threats.
+Added: • Established an Artificial Intelligence Executive Working Committee to ensure a “Secure by Design” approach to implementations of artificial intelligence.
• The Company maintains current incident response and business continuity plans, which are periodically updated and tested.
11 unchanged sentences
This could expose us to potentially significant claims and damages.
−Removed: As of December 31, 2023, there were no risks from cybersecurity threats, including due to any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.
+Added: As of December 31, 2024, there were no cyber incidents that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.