Company: EAI
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000065984-25-000012
Chunk: 168

Company: ENTERGY ARKANSAS, LLC
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1A
Chunk 168
---
 reputation.

Item 1B.  Unresolved Staff Comments

None.

Item 1C.  Cybersecurity

Risk Management and Strategy

Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability.  Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program.  The Chief Security Officer (CSO) is responsible for establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program.  The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program.  The Chief Information Officer (CIO) is responsible for ensuring that Entergy’s information technology infrastructure is secure and reliable.  The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies.  Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies.  Entergy and the Registrant Subsidiaries’ risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations.  Entergy and the Registrant Subsidiaries’ risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America’s electric grid, to protect sensitive information, and to maintain secure business operations.  Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners.  Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.Entergy and the Registrant Subsidiaries maintain access-management controls, including a layered multi-factor authentication process for network and system access, and a defense-in-depth security ecosystem that includes advanced threat detection from independent third parties and federal agencies, security logging and monitoring, and independent third-party penetration and vulnerability assessments.  Relevant employees and contractors must complete cybersecurity trainings periodically to heighten security and threat awareness, promote best practices, and meet regulatory