Company: DTK
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000936340-25-000065
Chunk: 97

Company: DTE ENERGY CO
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 97
---
 to help determine whether their information security protocols are sufficient.  If a service provider experiences a cyber incident, DTE Energy monitors their compliance with our security requirements; however, DTE Energy may not have the ability in all cases to effectively oversee the implementation of these control measures.

24

Table of Contents

The CSDC monitors and responds to actual and potential compromises from third-party service providers.  Access from a potentially compromised third-party is restricted until DTE Energy receives confirmation the compromise has been mitigated.DTE Energy has experienced, and expects to continue to be subject to, cybersecurity threats and incidents.  As of December 31, 2024, cybersecurity risks have not materially affected the Registrants’ business strategy, results of operations, or financial condition.  For additional discussion of the risks related to cybersecurity threats and incidents, see Item 1A. "Risk Factors."

Governance

DTE Energy has an enterprise risk management program to reduce overall risk, including risks related to cybersecurity, through comprehensive risk assessments and execution of corresponding mitigation plans.  Risks are reported and managed through various internal committees, which meet regularly and report at least annually to the Board of Directors.  These committees include:•The Risk Management Committee (RMC) is chaired by the Chief Executive Officer and comprised of the Chief Financial Officer, Chief Legal Officer, General Auditor, and other senior officers.  The RMC directs the development and maintenance of comprehensive risk management policies and procedures.  The RMC also sets, reviews, and monitors risk limits for enterprise-level risk and other exposures•The Operational Risk and Resilience (ORR) Committee is chaired by the President and Chief Operating Officer and comprised of operational leaders in DTE Energy’s business units.  The ORR is responsible for managing operational risks including safety, reliability, and cybersecurity at DTE Energy’s generation plants, substations, and other operating sites•The Technology Cybersecurity Committee (TCC) is a sub-committee of the ORR that focuses on information and operational technology risks related to cybersecurity, chaired by operational leaders in DTE Energy’s business units and includes the Chief Information Officer

Members of the Board of Directors serve roles on various committees responsible for their respective oversight and risk management.  The Audit Committee of the Board of Directors, comprised solely of independent directors, is responsible for reviewing DTE Energy’s cybersecurity risks, the results of any cybersecurity risk assessments and audits, and reports of investigations into significant events presented by DTE Energy’s IT department.  The Audit Committee reports to the Board