Company: CNLHP
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000072741-25-000007
Chunk: 33

Company: CONNECTICUT LIGHT & POWER CO
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 33
---
 may be insufficient in limits and coverage exclusions to cover all losses.

Any such cyberattacks could result in loss of service to customers and a significant decrease in revenues, which could have a material adverse impact on our financial position, results of operations, and cash flows.

For further information, see Item 1C, Cybersecurity included in this Annual Report on Form 10-K.

The unauthorized access to, and the misappropriation of, confidential and proprietary Company, customer, employee, financial or system operating information could adversely affect our business operations and adversely impact our reputation.

In the regular course of business, we, and our third-party suppliers, rely on information technology to maintain sensitive Company, customer, employee, financial and system operating information. We are required by various federal and state laws to safeguard this information. Cyber intrusions, security breaches, theft or loss of this information by cybercrime or otherwise could lead to the release of critical operating information or confidential Company, customer or employee information, which could adversely affect our business operations or adversely impact our reputation, and could result in significant costs, fines and litigation. We employ system controls to prevent the dissemination of certain confidential information and periodically train employees on phishing risks. We maintain cyber insurance to cover damages, costs related to a system disruption, potential ransom and defense costs arising from unauthorized disclosure of, or failure to protect, private information, as well as costs for notification to, or for credit monitoring of, customers, employees and other persons in the event of a breach of private information. This insurance covers amounts paid to address a network attack or the disclosure of personal information, and costs of a qualified forensics firm to determine the cause, source and extent of a network attack or to investigate, examine and analyze our network to find the cause, source and extent of a data breach, but it may be insufficient to cover all losses. While we have implemented measures designed to prevent network attacks and mitigate their effects should they occur, these measures may not be effective due to the continually evolving nature of efforts to access confidential information.

16

Regulatory, Legislative and Compliance Risks:

The actions of regulators and legislators could result in outcomes that may adversely affect our earnings and liquidity.

The rates that our electric, natural gas and water companies charge their customers are determined by their state regulatory commissions. These commissions also regulate the companies' accounting, operations, the issuance of certain securities and certain other matters. The FERC regulates the transmission of electric energy, the sale of electric energy at wholesale, accounting, issuance of certain securities and certain