4 unchanged sentences
A successful cyber-attack could have far-reaching consequences, from compromising the integrity of sensitive data to disrupting power supply.
−Removed: To that end, the Company implements a robust risk management, strategy, and governance regime aimed at ensuring effective controls are in place to identify, mitigate, remediate, and communicate cyber threats at appropriate levels within the organization.
+Added: To that end, the Company implements a robust risk management, strategy, and governance regime aimed at implementing controls to identify, mitigate, remediate, and communicate cyber threats at appropriate levels within the organization.
APS’s cybersecurity group (the “Cybersecurity Group”) is comprised of cybersecurity analysts, engineers, architects, and others, led by the Director of Cybersecurity, who reports to APS’s Vice President, Operations Support.
−Removed: The Director of Cybersecurity has more than twenty years of experience in information technology and cybersecurity roles, with more than ten of those years at the Company.
+Added: The Director of Cybersecurity has more than twenty years of experience in
+Added: information technology and cybersecurity roles, with more than ten of those years at the Company.
The Director of Cybersecurity also holds cybersecurity certifications from multiple certifying bodies and is active in utility cybersecurity professional organizations.
8 unchanged sentences
The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents to management and the Board of Directors.
−Removed: Once an incident meets certain criteria, the Company’s Cybersecurity Incident Command or, in the most severe cases that
−Removed: impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident.
+Added: Once an incident meets certain criteria, the Company’s Cybersecurity Incident Command or, in the case of a potentially severe threat that could impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident.
The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident’s materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.
Cybersecurity risk management has been integrated into the Company’s overall enterprise risk management program (the “Enterprise Risk Management Program”) through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization.
−Removed: The Enterprise Risk Management Program is overseen by an executive committee (the “ Executive Risk Committee ”), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer.
+Added: The Enterprise Risk Management Program is overseen by an executive committee (the “ Executive Risk Committee ”), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman, President, and Chief Executive Officer, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer.
Every year, as a part of the Enterprise Risk Management Program, risks affecting the Company are identified.
−Removed: For 2024, cybersecurity was identified as a risk.
+Added: Cybersecurity is among the enterprise risks assessed annually and was identified as a top risk in 2025.
The applicable subject matter experts brief the Company’s Board of Directors on the status of all top enterprise risks at least once per year.
−Removed: Finally, the Nuclear and Operating Committee of the Company’s Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors’ Audit Committee.
−Removed: To date, we do not believe there have been risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Pinnacle West or APS.
+Added: Finally, the Nuclear and Operating Committee of the Company’s Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings in-person or virtually at least twice per year from the Cybersecurity Group, and notable
+Added: audit findings relating to cybersecurity are aggregated and provided to the Board of Directors’ Audit Committee.
+Added: To date, we do not believe there have been any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pinnacle West or APS.
However, there is no assurance that will continue to be the case.
−Removed: If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions and our business strategy, results of operations, and financial condition could all be materially impacted.
−Removed: See the risk factor entitled, “We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition” in Item 1A—Risk Factors for more information.
+Added: If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions could be materially impacted, which could materially adversely affect our results of operations and financial conditions.
+Added: See the risk factor entitled, “We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition” in Part I, Item 1A—Risk Factors for more information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.