Company: ENBSF
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000895728-25-000006
Chunk: 261

Company: ENBRIDGE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 261
---
ITEM 1C. CYBERSECURITY

Cybersecurity risk management, strategy and governance 

Oversight of cybersecurity is integrated into the responsibilities of the Board and its committees. The Board is responsible for identifying and understanding Enbridge’s principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.The Audit, Finance and Risk Committee (AFRC) provides primary oversight of cybersecurity matters, including with respect to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. Management provides quarterly cybersecurity reports to the AFRC and the Board and also reports to the Safety and Reliability Committee, as deemed necessary, on cybersecurity issues related to safety, reliability and operations. 

62

Each year, management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks, highlighting top risks and trends (including cybersecurity). The annual CRA is an integrated enterprise-wide process which engages each part of our business to assess and rank risks based on impact and probability. We strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk categories relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the Safety and Reliability Committee an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and of treatments in place to manage those risks.   Cybersecurity has been identified as a top risk, as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Although we devote significant resources and security measures to prevent unwanted intrusions and to protect our systems and data, we (and our third-party vendors) have experienced, and expect to continue to experience, cyber attacks of varying degrees in the conduct of our business, including, for example, denial of service attacks. Cybersecurity risk is described in Item 1A. Risk Factors.  Enbridge’s management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO). We also engage independent third parties to assess our cybersecurity program