Company: CNLHP
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000072741-25-000007
Chunk: 48

Company: CONNECTICUT LIGHT & POWER CO
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 48
---
 a cyber security incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer:•Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company’s cyber program has been modeled after the Department of Energy’s Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. •Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. •Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. •Established an Artificial Intelligence Executive Working Committee to ensure a “Secure by Design” approach to implementations of artificial intelligence.•The Company maintains current incident response and business continuity plans, which are periodically updated and tested. •Network activity is monitored on an ongoing basis.•Anti-phishing and malware tools are utilized and assessed. •Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry. 

22

Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company’s Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security’s list of Prohibited Nations to further protect the Company’s supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology.  Our existing insurance limits may be inadequate to cover a material cyber incident.  This could expose us to potentially significant claims and damages.  

As of December 31, 2024, there were no cyber incidents that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.