UNRESOLVED STAFF COMMENTS
+Added: Table of C o ntents
CYBERSECURITY
1 unchanged sentence
In addition, we use information technology systems to collect and retain sensitive information, including confidential and proprietary information about our businesses, and personal information about our customers, shareowners and employees.
−Removed: Cybersecurity risks are identified through the enterprise risk management (ERM) program as key risks we face.
−Removed: These risks could include use of malicious code, employee theft or misuse, advanced persistent threats, vulnerabilities, fraud attempts, and phishing attacks that could cause, among others, an information technology system failure, or breach or loss of sensitive information.
+Added: Cybersecurity risks are identified as key risks through the enterprise risk management (ERM) program.
+Added: These risks could include use of malicious code, employee theft or misuse, advanced persistent threats, vulnerabilities, fraud attempts, and phishing attacks that could cause, among others, an operations or information technology system failure, or breach or loss of sensitive information.
The potential impact of cybersecurity risks on our business operations, results of operations or financial condition is discussed in the “ R i sks R elated to Business Operations ” section of Item 1A “ Risk Factors .” We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties or settlement costs related to any cybersecurity breaches or incidents.
However, measures that we take to avoid, detect, mitigate or recover from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations and financial condition.
−Removed: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical information technology and telecommunication systems and safeguard sensitive information .
−Removed: The cybersecurity program is assessed against industry standards, including the Center for Internet Security critical security controls.
+Added: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical operations, information technology and telecommunication systems and safeguard sensitive information .
+Added: The cybersecurity program is assessed against industry standards, including certain Center for Internet Security critical security controls.
This assessment is conducted by a third party periodically and internally at least annually.
We are also required to comply with cybersecurity standards under the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection and by the Department of Homeland Security Transportation Security Administration.
−Removed: We also periodically collaborate with law enforcement experts, external assessors, consultants, industry peers and other third parties in connection with understanding market and threat conditions used to identify, assess and mitigate cyber security risks.
−Removed: Table of C o ntents
+Added: We also periodically collaborate with federal and state law enforcement experts, external assessors, consultants, industry peers and other third parties in connection with understanding market and threat conditions used to identify, assess and mitigate cyber security risks.
The cybersecurity program includes:
• a dedicated cybersecurity team;
−Removed: • information technology and telecommunication systems implemented with segmentation and multiple levels of access controls;
+Added: • operations, information technology and telecommunication systems implemented with segmentation and multiple levels of access controls;
• a security operations center that continuously monitors information technology and telecommunications systems;
11 unchanged sentences
Additionally, third parties that have access to information technology systems, data or facilities that house such systems or data, agree by contract to manage their cybersecurity risks, provide notification in the event of a cybersecurity incident, and be subject to cybersecurity audits.
−Removed: Our cybersecurity program is overseen by our Senior Vice President and CIO, who has nearly two decades of experience in information technology, having previously held CIO roles with other organizations, as well as experience in the utility sector.
+Added: Our cybersecurity program is overseen by our Senior Vice President and CIO , who has nearly four decades of experience in information technology, including two decades as a CIO, having previously held CIO roles with other organizations, as well as experience in the utility sector.
The CIO oversees a team dedicated to the support of cybersecurity tools and the overall cybersecurity program.
5 unchanged sentences
Management, including the CIO, provides reports approximately quarterly to the Board regarding risks, threats, the threat landscape, assessments of and improvements to the cybersecurity program, and internal response preparedness.
+Added: Table of C o ntents
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.