Company: CNLHP
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000072741-25-000007
Chunk: 47

Company: CONNECTICUT LIGHT & POWER CO
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 47
---
Item 1C.  Cybersecurity 

The Company’s policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company’s enterprise-wide risks, including risks associated with cyber and physical security, and the Company’s programs and practices to monitor and mitigate these risks.Management prepares comprehensive cyber security reports that are discussed at each meeting of the Finance Committee. The reports focus on the changing threat landscape and the risks to the Company, describe Eversource’s cyber security drills and exercises, attempted and actual breaches on our systems, cyber incidents within the utility industry and around the world, and mitigation strategies. In addition, third-party experts of cyber security risks provide periodic assessments to the utility industry and the Company in particular to the Finance Committee. The Company regularly reviews and updates its cyber and system security programs, and the Finance Committee continues to enhance its robust oversight activities, including meetings with financial, information technology, legal and accounting management, other members of the Board, representatives of the Company’s independent registered public accounting firm, and outside advisors and experts in cyber security risks, at which cyber and system security programs and issues that might affect the Company’s financial statements and operational systems are discussed.The Company has a robust Enterprise Risk Management Program that has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company’s Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer.  Members include key leaders of the Company, including the Chief Information Officer. The Company is committed to continuous monitoring and assessment of cyber security controls. The Chief Information Security Officer is responsible for developing, implementing, and enforcing our cyber security program and information security policies to protect the Company’s information systems and operational assets. The Chief Information Security Officer position requires at least 15 years of relevant information security experience and relevant security certifications. The Chief Information Security Officer reports directly to the Chief Information Officer and provides regular updates to the executive management team. Our Chief Information Security Officer has over 20 years of relevant experience.The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit. To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate