Company: PCG-PB
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001004980-25-000010
Chunk: 32

Company: PG&E Corp
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 32
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

The objective of PG&E Corporation’s and the Utility’s cybersecurity program is to protect information assets and to mitigate against material cybersecurity threats, data and information compromise, and other risk events that could materially affect the business strategy, results of operations, or financial condition of PG&E Corporation and the Utility.  PG&E Corporation’s and the Utility’s cybersecurity program’s strategy is to establish multiple layers of defense through logical and physical security controls so that if any particular control proves insufficient, other controls may capture and mitigate that risk, such as:•Developing organizational understanding in managing cybersecurity risks to systems, assets, and data by regularly assessing cybersecurity internal controls and program maturity, including engaging independent third parties and participating in external regulatory compliance assessments;•Assessing, monitoring, and imposing contractual requirements on third-party service providers for cybersecurity risks and for compliance with PG&E Corporation’s and the Utility’s policies regarding access to company networks, information security, and technology;•Configuring and monitoring the system; employing policies, controls, and security tools, including training for employees and contractors; and limiting access and operating firewall rules as necessary and appropriate;•Utilizing multiple government and private assessors, consultants, auditors or other third parties, as well as an internal team, for intelligence gathering, security monitoring, threat hunting, and forensic activities;•Monitoring emerging data protection laws and regulations and implementing changes to processes designed to comply with any such laws and regulations;•Responding to cybersecurity incidents as they are detected by containing consequences, investigating causes and impacts, and implementing mitigations;•Maintaining and utilizing plans for resilience, mitigation, and restoring any capabilities or services that were impaired due to a cybersecurity incident;•Maintaining cybersecurity liability insurance;•Maintaining physical controls on a risk-informed basis, including controlling access or monitoring as appropriate; and•Continuously improving the cybersecurity program by incorporating learning from past experiences and testing, reviewing, and enhancing the controls and capabilities discussed above, including conducting regular cybersecurity incident-response exercises.PG&E Corporation and the Utility have identified cybersecurity as a key enterprise risk, which they manage through their enterprise risk management system.PG&E Corporation and the Utility have not experienced any cybersecurity incidents in the last three years that have materially affected the business strategy, results of operations, or financial condition of PG&E Corporation and the Utility.  For more information regarding how cybersecurity threats could materially affect PG&E Corporation and the Utility, see “The Utility’s operational networks and information technology systems could be impacted