Company: SOJE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000092122-25-000018
Chunk: 923

Company: SOUTHERN CO
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1
Chunk 923
---
 sharing to assess insider threat activity is employed. The Southern Company system regularly reviews and updates its plans, policies, and technologies and conducts regular training exercises and crisis management preparedness activities to test their effectiveness. In addition, a security awareness program for the Southern 

I-28

    Table of Contents                                Index to Financial Statements

Company system's employees has also been implemented, which is designed to educate and train employees at least annually, or more often as needed, about risks inherent to human interaction with information and operational technology.The Southern Company system's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with both the Electricity Information Sharing and Analysis Center and the Downstream Natural Gas Information Sharing and Analysis Center, the Southern Company system benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps to allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, the Southern Company system also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.Many cybersecurity policies and standards across the Southern Company system are governed by multiple regulatory requirements. Portions of these policies and standards are audited by the FERC, the Transportation Security Administration, and the NRC, as appropriate, and are periodically evaluated by third parties such as cybersecurity insurance carriers. Certain members of senior management have high-level security clearances to facilitate access to critical information, and the Southern Company system participates in pilot programs with industry and the U.S. government to share additional information and strengthen cybersecurity and business resiliency.The Southern Company system also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, or customer or otherwise implicating the third-party technology and systems used. Among other things, the Southern Company system has established a Vendor Security Incident Working Group to address such third-party security incidents, including following up with the third party as appropriate and taking steps to mitigate any impact to systems. The Vendor Security Incident Working Group includes members of the internal cybersecurity teams to address any incidents that may invoke the CIRP. Additionally, the Southern Company system typically imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to the Southern Company system's data and systems