Company: POR
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000784977-25-000012
Chunk: 82

Company: PORTLAND GENERAL ELECTRIC CO /OR/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 82
---
ITEM 1C.    CYBERSECURITY.

PGE considers cybersecurity to be a top enterprise risk in PGE’s enterprise risk management program, and manages the risk by adhering to established security policies and governance, identifying risk through risk assessments, utilizing technology to provide a layered security approach, controlling access, robust security awareness training and conducting resiliency exercises. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company’s future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—“Risk Factors.” The Company has not experienced a material cybersecurity incident.

PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk. 

An enterprise-wide management group operates to evaluate the cybersecurity program’s effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors.

PGE has a management-level committee, the Integrated Security Executive Committee (ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company’s management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer,