Company: DTK
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000936340-25-000065
Chunk: 96

Company: DTE ENERGY CO
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 96
---
Item 1C. Cybersecurity

Risk Management and Strategy

DTE Energy maintains cybersecurity measures designed to protect its physical and digital infrastructure in order to provide safe and reliable delivery of energy to customers.  These measures serve to maintain compliance with regulations and protect the confidentiality, integrity and availability of confidential and proprietary information, DTE Energy’s computing resources, and the electrical and gas systems.To protect against cybersecurity threats, DTE Energy employs a dedicated cybersecurity team led by the Chief Information Officer.  The cybersecurity team is responsible for implementing proper safeguards to mitigate the risk of cyber threats, including but not limited to firewalls, continuous monitoring, and training.  DTE Energy also engages with third parties to conduct cybersecurity maturity assessments to provide an independent and objective view of our cybersecurity and assess opportunities for improvement.  The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is the basis for these assessments to manage cyber risks, mature and monitor existing security controls, and communicate security posture coherently.  The NIST CSF provides a common language to understand, manage, and express cyber risks internally and externally.Another component of DTE Energy’s cybersecurity team is the Cybersecurity Defense Center (CSDC), which has the primary responsibility for monitoring and responding to cybersecurity incidents.  The CSDC maintains an incident response plan designed to protect against, detect, evaluate, and respond to and recover from a cyber incident.  The CSDC may receive incident reports from DTE Energy employees, corporate security, or external sources.  The incident response plan is intended to be flexible so it may be adapted to an array of potential scenarios.  Depending on the incident, the CSDC may decide to engage external resources for assistance with responding to the incident.  DTE Energy regularly conducts exercises to help ensure the plan’s effectiveness and overall preparedness.DTE Energy engages third-party service providers to assist with managing various aspects of its business.  These service providers are subject to due diligence reviews of their information security programs prior to onboarding.  DTE Energy also contractually requires service providers with access to its information technology (IT) systems, sensitive business data, or personal information to implement and maintain appropriate security controls and restricts their ability to use such data for purposes other than to provide services to DTE Energy, except as required by law.  Third-party service providers are also contractually required to notify DTE Energy promptly of cyber incidents that may affect any systems or data.  DTE Energy collaborates with its service providers