UNRESOLVED STAFF COMMENTS
−Removed: 2023 Form 10-K 38
−Removed: WEC Energy Group, Inc.
CYBERSECURITY
16 unchanged sentences
Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program’s effectiveness, industry collaboration, and employee training and awareness.
−Removed: Our cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity.
+Added: Our cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the DOE to continually assess its maturity.
This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of our security controls, including technical, physical, and social aspects.
6 unchanged sentences
Pursuant to the terms of the Plan, we have established a CSIRT Steering Committee which includes, among others, the Chief Financial Officer, CAO, and the Enterprise Security Director.
−Removed: The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including the CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the Board of Directors at regularly scheduled meetings or more frequently, as needed.
+Added: The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity
2024 Form 10-K 40
WEC Energy Group, Inc.
+Added: threat or incident and provides updates regarding the status of the response to senior management, including the CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the Board of Directors at regularly scheduled meetings or more frequently, as needed.
In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident.
7 unchanged sentences
Risk Factors and the risk factor titled "Our operations are subject to risks beyond our control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information."
−Removed: 2023 Form 10-K 40
−Removed: WEC Energy Group, Inc.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.