16 unchanged sentences
We also leverage third-party benchmarking, the results from regular internal and third-party audits, technology partner resources, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and allocate resources.
−Removed: Beginning in May 2021, the Department of Homeland Security’s (DHS) Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural.
−Removed: These directives cumulatively required owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies;
+Added: Beginning in May 2021, the Department of Homeland Security’s (DHS) and the Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural.
+Added: These directives cumulatively require owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies;
implement a significant number of specified cyber security controls and processes;
1 unchanged sentence
We made significant additional and accelerated investments in cybersecurity in response to the TSA directives.
+Added: In November 2024, the TSA proposed regulations with the aim of making the security directives permanent by incorporating them into the US Code of Federal Regulations.
Our cybersecurity program has several fundamental tenants, including security governance, cybersecurity risk management, compliance, defensibility, zero-trust architecture and cloud security.
8 unchanged sentences
In accordance with our program and processes, we regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities.
−Removed: We conduct regular reviews and tests of our information security program and also utilize audits by our internal audit team and third-party consultants, table-top exercises, penetration and vulnerability testing, data recovery testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.
+Added: We conduct regular reviews and tests of our information security program and also utilize audits by our internal audit team and third-party consultants, table-top exercises, penetration and vulnerability testing, data recovery testing, simulations, and other exercises to evaluate the effectiveness of our information security program
+Added: and improve our security measures and planning.
We are continuously working to evolve our oversight processes to mature how we identify and manage cybersecurity risks, and we perform periodic maturity assessments to measure our progress.
As a regulated energy infrastructure company, for decades we have used an incident command system (ICS) as a standardized approach to the command, control and coordination of a variety of emergency situations.
−Removed: In the event of emergencies, including cybersecurity events, we stand up an Incident Command Team to respond to the emergency.
+Added: In the event of emergencies, including cybersecurity events, we stand up a cross-functional Incident Command Team (ICT) to respond to the emergency.
We exercise and train the ICT for a variety of emergencies, including cyber events on a regular basis.
3 unchanged sentences
We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
−Removed: See Item 1A, "Risk Factors” above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, and technology disruptions and failures, our reliance on technology.
+Added: See Item 1A, "Risk Factors” above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, technology disruptions and failures, and our reliance on technology.
Cybersecurity Governance
7 unchanged sentences
Our management team, including our Cybersecurity management team, has primary responsibility for our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.
−Removed: Our Cybersecurity management team has been led, since 2017, by our Vice President, Chief Information Officer, who also functions as our Chief Information Security Officer and reports to our CEO.
−Removed: Downing has an extensive career of 29 years in information technology services in the energy sector, including at WorleyParsons, British Petroleum and Schlumberger.
−Removed: He holds a degree in Information Systems as well as a Masters of Business Administration.
−Removed: Downing is supported by Mr.
−Removed: Carlson, our Director of Cybersecurity and Compliance, and his team.
−Removed: Carlson has 24 years of experience in information technology focused on highly regulated sectors including energy, government, and insurance.
−Removed: He holds a bachelor’s degree in Information Technology, and master’s degrees in Information Assurance and Business Administration.
−Removed: The remainder of our team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity, threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.
+Added: Our Cybersecurity management team is led by Brian Fellon, our Vice President, Chief Information Officer and Chief Information Security Officer (VP, CIO and CISO).
+Added: Fellon joined NW Natural and was appointed to his role by the Board of Directors in September 2024.
+Added: Fellon reports to our Chief Financial Officer.
+Added: He has 28 years of experience in information technology.
+Added: Prior to joining NW Natural, Mr.
+Added: Fellon served as Director of Information Technology at Puget Sound Energy in Bellevue, Washington from 2016 to September 2024, where he was responsible for applications services, artificial intelligence and data.
+Added: Fellon is supported by our Director of Cybersecurity and Compliance, and his team.
Collectively our team has certifications from various organizations such as American Society for Industrial Security, AXELOS, Cloud Security Alliance, Information Systems Audit and Control Association, International Information System Security Certification Consortium and SANS Institute.
Our cybersecurity and compliance team regularly collects data on cybersecurity threats and risk areas, monitors our systems, and conducts testing to assess our processes and procedures and the threat landscape.
−Removed: The CIO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.
+Added: Our VP, CIO and CISO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.
In the event of an incident, we intend to utilize our ICT and follow our detailed incident program and processes, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.