Company: WELPM
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000107815-25-000105
Chunk: 80

Company: WISCONSIN ELECTRIC POWER CO
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 80
---
 WEC Energy Group's CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the WEC Energy Group Board of Directors at regularly scheduled meetings or more frequently, as needed. In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of WEC Energy Group's CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.

We have been subject to attempted cybersecurity attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. For information about cybersecurity risks to our business, see Item 1A. Risk Factors and the risk factor titled "Our operations are subject to risks beyond our 

2024 Form 10-K30Wisconsin Electric Power Company

Table of Contents

control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information."