Company: AILIM
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001002910-25-000055
Chunk: 226

Company: Ameren Illinois Co
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 226
---
 reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are continuously tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The plans and procedures are also designed to escalate incidents to appropriate members of management to guide the prevention, detection, response, recovery, and remediation from a material cybersecurity incident. These cybersecurity plans and procedures are positioned to promote the expedient identification, escalation, handling and reporting of a potentially material cybersecurity event or incident. To address cybersecurity threats, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.Ameren employs a third-party cybersecurity risk management program, which extends the governance elements of Ameren’s cybersecurity program, in addition to other diligence measures, to our critical third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.We leverage common and widely accepted external cybersecurity risk management frameworks, such as the National Institute of Standards and Technology Cybersecurity framework, to assess, guide, and enhance our cybersecurity posture. Our program effectiveness is measured through formal cybersecurity scorecards and metrics reported to senior-level Ameren officers, the risk management steering 

30

Table of Contents

committee, and the Cybersecurity and Digital Technology Committee. These metrics include but are not limited to measures on the effectiveness of our cybersecurity controls across core National Institute of Standards and Technology Cybersecurity framework functions (Govern, Identify, Protect, Detect, Respond, and Recover), our ability to manage first- and third-party cybersecurity events and incidents, cybersecurity incident response exercises, results of our recurring internal assessments, vulnerability assessments, penetration tests, external assessments, and audits that Ameren regularly undergoes. Ameren regularly engages external cybersecurity experts to assist with evaluating our cybersecurity program. These engagements provide insights into control design and implementation, prioritized recommendations for enhancements to our cybersecurity strategy, and an overview of the cybersecurity threat landscape that collectively inform our investments and technical controls to protect Ameren's most critical assets. The results of these engagements are reviewed with senior-level Ameren officers, the risk management steering committee, and the Cybersecurity and Digital Technology Committee.We are not aware of any cybersecurity events that have