Company: SCE-PL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000827052-25-000022
Chunk: 459

Company: SOUTHERN CALIFORNIA EDISON Co
Filing Date: 2025-02-27
Form: 10-K
Item: Item 8
Chunk 459
---
 and cascading impacts (such as rain on snow or debris flow) on SCE in the 2030, 2050, and 2070 timeframes. SCE's CAVA will inform planning related to SCE assets, operations, and services, with the goal of maintaining a resilient electric grid in the face of climate change and will inform future investment in the grid.

For more information on risks related to climate change, environmental regulation and SCE's business strategy, see "Risk Factors—Risks Relating to Southern California Edison Company—Operating Risks."

UNRESOLVED STAFF COMMENTS

None.

CYBERSECURITY

Overview

Cybersecurity presents an ever-evolving challenge to the electric power industry and Edison International and SCE have identified cybersecurity as a key enterprise risk. SCE's operations require the continuous availability of critical information and operational technology systems, sensitive customer and employee data, and infrastructure information, all of which are targets for malicious actors. Cybersecurity attacks, which can arise from external actors, internal threats, or through SCE's supply chain, are continually becoming more frequent and more sophisticated. SCE's grid modernization efforts and the transition to a more connected grid, including incorporating communication and operating technologies aimed at enabling SCE to respond faster, operate its systems more efficiently and reliably, and incorporate DERs at a greater level, also increases SCE’s vulnerability to cybersecurity attacks. To SCE's knowledge it has not experienced a material cybersecurity incident to date. SCE’s increased reliance on technology necessarily increases cybersecurity risk. Cybersecurity incidents that may cause a major disruption of SCE's operations, and therefore may materially affect Edison International and SCE's financial 

133

Table of Contents

condition, operations, and business reputation, include cyber attacks designed to compromise or exfiltrate data (e.g., ransomware attacks), damage or destroy systems, interrupt availability, conduct future malicious actions, and/or gain control of or otherwise interrupt the operation of SCE’s electric grid. For additional information on risks from cybersecurity threats that may have a material effect on Edison International and SCE, see the "Risks Relating to Edison International and Southern California Edison Company—Cybersecurity and Physical Security Risks."

Risk Management, Strategy and Oversight SCE assesses and monitors cybersecurity risks to current infrastructure, new projects, and third parties, including vendors. SCE maintains incident response plans, utilizes cybersecurity incident response exercises, performs targeted audits, leverages third party assessments and uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) as a guideline to identify, evaluate and manage material