Company: EAI
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000065984-25-000012
Chunk: 169

Company: ENTERGY ARKANSAS, LLC
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1A
Chunk 169
---
 requirements.  Additional multi-layered prevention and detection processes and technologies to mitigate and minimize the effects of cybersecurity risks include email security, continuous monitoring, vulnerability scanning, anti-virus and anti-malware software, backups and recovery strategy, network segregation, third-party security, and information protection.Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents.  This includes the Entergy Incident Response Team Plan, which outlines Entergy’s procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident.  The plan details the roles and responsibilities of Entergy’s officers who would be engaged in such a response to an emergency incident, 

315

Table of ContentsPart I Item 1A, 1B, and 1CEntergy Corporation, Utility operating companies, and System Energy

including key questions to be addressed, critical decision points, and sources of key information to support decision-making.  Senior management and the Emergency Incident Response Team periodically review and drill on the plan.As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats.  To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise.  A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection.  Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from certain third-party vendors.  In addition, Entergy and the Registrant Subsidiaries utilize technology and threat-intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.

While Entergy and the Registrant Subsidiaries have experienced cybersecurity incidents, except as otherwise summarized above or discussed elsewhere in this report, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected them including their business strategy, results of operations, or financial condition.  See “Item 1A. Risk Factors” in Part I, Item 1A for a detailed description of the risks related to cybersecurity.

Corporate Governance

The Board of Directors is responsible for oversight of the identification, management