10 unchanged sentences
The companies engage with consultants and other third parties as necessary to design, enhance, and implement appropriate cybersecurity measures in seeking to mitigate risks from cybersecurity threats.
−Removed: As part of the companies' strategy to manage risks from cybersecurity threats with third-party service providers, the companies seek to include appropriate security clauses in their contracts with those providers, including incident reporting requirements.
−Removed: A dedicated cybersecurity team lead by a cybersecurity manager oversees the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power.
−Removed: The cybersecurity manager reports to Idaho Power's corporate security senior manager.
+Added: part of the companies' strategy to manage risks from cybersecurity threats with third-party service providers , the companies seek to include appropriate security clauses in their contracts with those providers, including incident reporting requirements.
+Added: A dedicated cybersecurity team lead by a cybersecurity manager and director of security oversee the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power.
+Added: The cybersecurity manager reports to Idaho Power's director of security.
The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.
6 unchanged sentences
The team is composed of individuals from the cybersecurity team and other departments within the companies with relevant expertise, as well as third-party contractors and vendors.
−Removed: As of the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition.
−Removed: However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect the companies, including their business strategy, results of operations, or financial condition.
+Added: Utilities are the operators of critical infrastructure and maintain sensitive information, and as such the industry has been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems and confidential information to disrupt operations or for monetary gain.
+Added: Idaho Power, like other entities in the utility industry, is experiencing an increase in the frequency and sophistication of these attempts.
+Added: For the year ended December 31, 2024, and the subsequent period to the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition.
+Added: However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that any such threat or incident will not materially affect the companies, including their business strategy, results of operations, or financial condition.
For more information regarding the risks the companies face from cybersecurity threats, see Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.