10 unchanged sentences
Central management and coordination of the program helps FirstEnergy to comprehensively evaluate and protect against cyber threats.
−Removed: FirstEnergy’s policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated.
+Added: FirstEnergy’s written policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated.
FirstEnergy aims to align its cyber security program with national standards.
2 unchanged sentences
FirstEnergy’s Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident.
−Removed: FirstEnergy also conducts various internal and external risk assessments each year, which are based on nationally accepted standards.
−Removed: These can include annual compliance required assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy’s environment, or benchmark/roadmap needs.
−Removed: Risks identified in such assessments are considered for inclusion in FirstEnergy’s risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization’s policies and procedures.
+Added: FirstEnergy also conducts various internal and external risk assessments each year.
+Added: These include required annual compliance assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry Data Security Standard compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy’s environment, or benchmark/roadmap needs.
+Added: Risks identified in such assessments are considered for inclusion in FirstEnergy’s risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization’s written policies and procedures.
The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks.
3 unchanged sentences
To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks.
−Removed: FirstEnergy is also currently evaluating its current third-party vendors to identify which vendors have similar access to personally identifiable information and expects to complete its analysis by the end of 2024.
+Added: In 2024, FirstEnergy also evaluated its current third-party vendors to identify which vendors had similar access to personally identifiable information and is currently reviewing the results of its analysis.
FirstEnergy conducts cyber security exercises and training.
−Removed: For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates the personnel on FirstEnergy’s policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems.
+Added: For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates personnel on FirstEnergy’s policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems.
FirstEnergy also conducts various tests of its cyber incident response plans, disaster recovery plans and business continuity plans with key stakeholders and responders for various areas of FirstEnergy’s utility and business functions.
13 unchanged sentences
To effectively manage oversight of FirstEnergy’s cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FirstEnergy’s Audit and Operations and Safety Committees, respectively, as detailed in each Committees’ charters.
−Removed: The Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of the FirstEnergy’s overall enterprise risk management program and the internal controls applicable to cyber security matters.
+Added: The Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of FirstEnergy’s overall enterprise risk management program and the internal controls applicable to cyber security matters.
The Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy’s cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters.
−Removed: FirstEnergy’s CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and the full FE Board.
+Added: FirstEnergy’s CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and to the full FE Board.
Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body.
3 unchanged sentences
The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification.
−Removed: The CISO reports directly to FirstEnergy’s Chief Information Officer.
+Added: The CISO reports directly to FirstEnergy’s Senior Vice President, Shared Services, who is responsible for all of FirstEnergy’s digital and technology services and is FirstEnergy’s most senior information technology executive.
Under the CISO’s oversight, FirstEnergy’s cyber security team implements and provides governance and functional oversight for cyber security controls and services.
−Removed: Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Chief Information Officer, legal, and the executive leaders as appropriate based on the severity of any such risk or incident.
+Added: Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Senior Vice President, Shared Services, legal, and the executive leaders as appropriate based on the severity of any such risk or incident.
In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.
−Removed: In the event of any significant cyber security incident, FirstEnergy’s Cyber Security Incident Response Plan provides for a severity determination by a cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact.
−Removed: Dependent upon the severity of an incident, it is FirstEnergy’s practice to escalate the incident to the Chief Information Officer, Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer.
−Removed: Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit and Operations and Safety Committees or full FE Board.
+Added: In the event of any significant cyber security incident, FirstEnergy’s Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact.
+Added: Dependent upon the severity of an incident, it is FirstEnergy’s practice to escalate the incident to the Senior Vice President, Shared Services, the Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer .
+Added: Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit Committee and Operations and Safety Committee, or the full FE Board.
Although the risks from cyber threats have not materially affected FirstEnergy’s business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.