Company: WELPM
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000107815-25-000105
Chunk: 79

Company: WISCONSIN ELECTRIC POWER CO
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 79
---
 security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. The Enterprise Security Director has over 27 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.

Cybersecurity Risk Management Program

Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program’s effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the DOE to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.As part of the cybersecurity program, WEC Energy Group has adopted a cybersecurity incident response plan (the “Plan”) designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, WEC Energy Group has established a CSIRT Steering Committee which includes, among others, WEC Energy Group's Chief Financial Officer (who also serves as our Chief Financial Officer), CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including