Company: MSEX
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001174947-25-000251
Chunk: 24

Company: MIDDLESEX WATER CO
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 24
---
 control of operational systems and delays in financial reporting and other management functions. Possible impacts associated
with a cyber-incident may include remediation costs related to lost, stolen, or compromised data, repairs to data processing systems,
increased cyber security protection costs, adverse effects on our compliance with regulatory and environmental laws and regulations, including
standards for drinking water, litigation and reputational damage.

We depend significantly on the technical and
management services of our team, and the departure of any of certain persons could cause our operating results to temporarily be short
of our expectations.

Our success depends significantly on the continued
individual and collective contributions of our team. If we lose the services of certain members of our team, or are unable to attract
and retain qualified personnel in key roles, our operating results could be negatively impacted.

ITEM 1B.UNRESOLVED STAFF COMMENTS.

None.

ITEM 1C.CYBERSECURITY

Cybersecurity Program

The Company’s cybersecurity program is an
integral element of the Company's overarching strategic plan and risk management system. The robustness of the cybersecurity initiatives
directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology
Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures
to safeguard its operational environment and data integrity systems.

The Company continually evaluates and refines
its cybersecurity program in response to key factors such as evolving threat landscapes, program maturation, gap analysis, and guidance
from external security consultants. The Company’s cybersecurity program relies on three key pillars: People, Process and Technology
(PPT) to deliver a robust cybersecurity program. The cybersecurity program includes various aspects of PPT, including, but not limited
to:

    ●
    Technology: Encryption, threat management, backups, monitoring, investigative support utilizing artificial intelligence embedded tools;

    ●
    Identity and Access Control Management Tools: Multi-factor authentication, monitoring and alerting of privilege account access;

    ●
    Cybersecurity Processes: Vulnerability scanning, penetration testing, and periodic assessments conducted by external security consultants;

    ●
    Incident Response Training: Regularly assessed incident response preparedness through various incident response and disaster recovery exercises; and

    ●
    Cyber Risk Awareness and Training: Frequent simulation exercises to heighten awareness of cybersecurity threats and educate our user community on preventative measures and reporting protocols.  All employees participate in required periodic training with respect to cybersecurity risk and risk mitigation.