Company: SCE-PL
Filing Date: 2025-09-08
Form Type: SF-1
Source: 0001193125-25-198426
Chunk: 24

Company: SOUTHERN CALIFORNIA EDISON Co
Filing Date: 2025-09-08
Form: SF-1
Chunk 24
---
icult for the servicer to collect the fixed recovery charges and adversely affect the value of your investment in the bonds.

- 27 -

SCE’s systems and assets are targets for physical and cyber-attacks that could result in their failure or reduced functionality and limit SCE’s ability to service the recovery property

Regulators such
as North American Electric Reliability Council and U.S. Government agencies, including the Departments of Defense, Homeland Security and Energy, have increasingly stressed that threat sources continue to seek to identify and exploit vulnerabilities
in the U.S. national electric grid and other critical energy infrastructures, and that such attacks and disruptions, both physical and cyber, are highly sophisticated and dynamic. Several U.S. Government agencies have highlighted the increasing
risks related to physical and cybersecurity attacks, including ransomware attacks, related to the electric sector, including its supply chains, and that the risks may escalate during periods of heightened geopolitical tensions.

SCE requires the uninterrupted use of sophisticated information and operational technology systems and infrastructure to monitor and operate
the electric grid. In the regular course of SCE’s business, it also handles a range of sensitive infrastructure, security, employee, customer, and business systems information. If SCE’s information technology and operational technology
systems’ security were to be compromised by physical or electronic means or a critical system or technology failure were to occur without timely recovery, including failure of new technology to be implemented as designed, SCE could be unable
to fulfill critical business functions, including the servicing of recovery property, and/or sensitive information could be misappropriated or compromised.

SCE interacts with a wide array of third parties and depends on vendors to provide it with services. Malicious actors may attack vendors to
disrupt the services they provide to SCE, or to use those vendors as a conduit to attack SCE. Additionally, the products and services provided by SCE’s vendors may contain vulnerabilities or otherwise. A compromise of equipment and/or
exfiltration of SCE data, whether by physical or by electronic means, could result in loss or changes to confidential or sensitive information and interruption of business processes. While SCE’s vendors have experienced cybersecurity
incidents, such incidents have not, to SCE’s knowledge, resulted in a material impact to SCE to date.

SCE’s systems have
experienced and will continue to face, cyber and physical security events involving malicious codes, unauthorized access attempts, vandalism and other illicit activities, but to SCE’s knowledge it has not experienced a material cybersecurity
or data breach to date. No security program can completely shield its systems