Company: SOJE
Filing Date: 2025-03-31
Form Type: PRE 14A
Source: 0000092122-25-000032
Chunk: 31

Company: SOUTHERN CO
Filing Date: 2025-03-31
Form: PRE 14A
Chunk 31
---
 risk oversight and management processes are established and operating effectively.

#### 32Southern Company2025 Proxy Statement

#### Governance
All Directors are actively involved in the risk oversight function, and we believe that our leadership structure supports the Board’s risk oversight responsibility. Each committee is chaired by an independent Director, and the Chairman and CEO does not serve on any committee. There is regular, open communication between management and the Directors.

|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |     | Spotlight on Cybersecurity and Artificial Intelligence Risks |
| Cybersecurity is a critical component of our risk management program. The Board devotes significant time and attention to overseeing cybersecurity risk, and our approach to cybersecurity governance establishes oversight throughout the enterprise.                                                                                                                                                                                                                                                                                                                                                                            
 4The Business Security and Resiliency Committee, comprised solely of independent Directors, is charged with oversight of risks related to cybersecurity, physical security and operational resiliency. The Business Security and Resiliency Committee includes directors with an understanding of cyber issues. The Business Security and Resiliency Committee meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chief Information Security Officer reports to the Business Security and Resiliency Committee at each regular committee meeting.                      
 4We use a cross-functional, risk-based, and “defense in depth” approach to prevent, detect, identify, mitigate, respond to and recover from cybersecurity threats and incidents. Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks related to cyber threats, we employ multiple technologies, processes and controls, all working independently but as part of a cohesive strategy to reduce risk. This strategy is regularly tested through auditing, penetration testing, vulnerability testing and other exercises designed to assess effectiveness.            
 4Overall network security efforts are led by the Chief Information Security Officer and the Technology Security Organization, the organization responsible for implementing, monitoring and maintaining cybersecurity practices across the Company, and aided by the COO and the Energy Management System and Generation Organization. We utilize a 24/7 Security Operations Center, which facilitates real-time situational awareness across the cyber-threat environment, and a robust Insider Threat Protection Program and Fusion Center that leverages cross-function information sharing to assess insider threat activity. 
 The Business Security and Resiliency Committee is also charged with oversight of the Company's use of AI and the associated benefits and risk management thereof. During 2024, the Company adopted an AI Acceptable Use Policy to guide employees in leveraging this technology for the benefit of our customers, while protecting data, helping