2 unchanged sentences
FirstEnergy seeks to protect its customers, employees, facilities and the ongoing reliability of the electric system.
−Removed: FirstEnergy works closely with state and federal agencies and its peers in the electric utility industry to identify physical and cyber security
−Removed: risks, exchange information, and put safeguards in place to comply with strict reliability and security standards.
+Added: FirstEnergy works closely with state and federal agencies and its peers in the electric utility industry to identify physical and cyber security risks, exchange information, and put safeguards in place to comply with strict reliability and security standards.
From a security standpoint, the electric utility sector is one of the most regulated industries.
+Added: As a wholly owned subsidiary of FE, JCP&L utilizes and falls under the purview of FirstEnergy’s cyber security risk management program.
Risk Management and Strategy
5 unchanged sentences
FirstEnergy aims to align its cyber security program with national standards.
−Removed: For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on the National Institute of Standards and Technology Cyber Security Framework and, for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards.
+Added: For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on, and in alignment with, the National Institute of Standards and Technology Cyber Security Framework, and for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards.
FirstEnergy also complies with various state laws and regulations on cyber security.
8 unchanged sentences
To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks.
−Removed: In 2024, FirstEnergy also evaluated its current third-party vendors to identify which vendors had similar access to personally identifiable information and is currently reviewing the results of its analysis.
+Added: FirstEnergy has also evaluated its third-party vendors onboarded prior to 2022 to identify which vendors had similar access to personally identifiable information and confirmed that such vendors also completed a privacy impact assessment.
FirstEnergy conducts cyber security exercises and training.
9 unchanged sentences
Also, FirstEnergy, or its vendors and service providers, may be at an increased risk of a cyber-attack and/or data security breach due to the nature of its business.
−Removed: Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems
−Removed: or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.
+Added: Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.
Board Governance and Management
The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy’s enterprise risk management process.
−Removed: Responsibility for oversight of risk management generally lies with the FE Board and the Audit Committee has primary responsibility to oversee enterprise risk management.
+Added: Responsibility for oversight of risk management generally lies with the FE Board and the FE Audit Committee has primary responsibility to oversee enterprise risk management.
To effectively manage oversight of FirstEnergy’s cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FirstEnergy’s Audit and Operations and Safety Committees, respectively, as detailed in each Committees’ charters.
1 unchanged sentence
The Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy’s cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters.
−Removed: FirstEnergy’s CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and to the full FE Board.
+Added: FirstEnergy’s Cyber Security Leaders regularly provide reports at the Audit Committee, Operations and Safety Oversight Committee, and to the full FE Board.
Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body.
1 unchanged sentence
At the executive and management level, the CISO has primary responsibility for the development, operation, and maintenance of FirstEnergy’s cyber security program.
−Removed: The CISO has 6 years of experience in technology risk management, all of which have been with FirstEnergy, and an additional 23 years of experience in information technology.
−Removed: The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification.
−Removed: The CISO reports directly to FirstEnergy’s Senior Vice President, Shared Services, who is responsible for all of FirstEnergy’s digital and technology services and is FirstEnergy’s most senior information technology executive.
+Added: FirstEnergy's CISO has over 30 years of cyber-experience with both large domestic and international companies, and holds an ISC2 Certified Information Systems Security Professional certification.
+Added: The CISO reports directly to FirstEnergy’s Chief Information Officer, who is responsible for all of FirstEnergy’s digital and technology services and is FirstEnergy’s most senior information technology executive.
Under the CISO’s oversight, FirstEnergy’s cyber security team implements and provides governance and functional oversight for cyber security controls and services.
−Removed: Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Senior Vice President, Shared Services, legal, and the executive leaders as appropriate based on the severity of any such risk or incident.
+Added: Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Chief Information Officer, Chief Operating Officer, FirstEnergy's legal team, and the executive leaders as appropriate based on the severity of any such risk or incident.
In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.
In the event of any significant cyber security incident, FirstEnergy’s Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact.
−Removed: Dependent upon the severity of an incident, it is FirstEnergy’s practice to escalate the incident to the Senior Vice President, Shared Services, the Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer .
+Added: Dependent upon the severity of an incident, it is FirstEnergy’s practice to escalate the incident to the Chief Information Officer, the Chief Risk Officer, FirstEnergy's legal team, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer .
Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit Committee and Operations and Safety Committee, or the full FE Board.
Although the risks from cyber threats have not materially affected FirstEnergy’s business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk.
+Added: The FirstEnergy Cyber Security team also monitors new and emerging threats and is constantly improving and refining its security controls to respond not only to those new and emerging threats, but also to address the security impact and requirements of new technologies such as artificial intelligence and quantum computing.
Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy’s cyber security program, including FE’s risk management strategy and the controls designed to protect its operations.
Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents.
−Removed: Risk Factors for additional information regarding FirstEnergy’s cyber security risks.
−Removed: Those sections of Item 1A.
−Removed: Risk Factors should be read in conjunction with this Item 1C.
−Removed: Cybersecurity.
+Added: See Item 1A., "Risk Factors" for additional information regarding FirstEnergy’s cyber security risks.
+Added: Those sections of Item 1A., "Risk Factors" should be read in conjunction with this Item 1C., "Cybersecurity".
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.