Company: SCE-PL
Filing Date: 2025-10-28
Form Type: SF-1/A
Source: 0001193125-25-253849
Chunk: 23

Company: SOUTHERN CALIFORNIA EDISON Co
Filing Date: 2025-10-28
Form: SF-1/A
Chunk 23
---
 technology systems and infrastructure to monitor and operate
the electric grid. In the regular course of SCE’s business, it also handles a range of sensitive infrastructure, security, employee, customer, and business systems information. If SCE’s information technology and operational technology
systems’ security were to be compromised by physical or electronic means or a critical system or technology failure were to occur without timely recovery, including failure of new technology to be implemented as designed, SCE could be unable
to fulfill critical business functions, including the servicing of recovery property, and/or sensitive information could be misappropriated or compromised.

SCE interacts with a wide array of third parties and depends on vendors to provide it with services. Malicious actors may attack vendors to
disrupt the services they provide to SCE, or to use those vendors as a conduit to attack SCE. Additionally, the products and services provided by SCE’s vendors may contain vulnerabilities or otherwise. A compromise of equipment and/or
exfiltration of SCE data, whether by physical or by electronic means, could result in loss or changes to confidential or sensitive information and interruption of business processes. While SCE’s vendors have experienced cybersecurity
incidents, such incidents have not, to SCE’s knowledge, resulted in a material impact to SCE to date.

SCE’s systems have
experienced and will continue to face, cyber and physical security events involving malicious codes, unauthorized access attempts, vandalism and other illicit activities, but to SCE’s knowledge it has not experienced a material cybersecurity
or data breach to date. No security program can completely shield its systems, infrastructure, and data from attacks, intrusions or other catastrophic events that could result in their failure or reduced functionality. There is no guarantee that
SCE’s security program, including prevention, detection, mitigation, and remediation of risks, will prevent all future cyber and physical security incidents that could materially impact its operations or financial condition.

If SCE’s information technology and operational technology systems’ security measures were to be breached, or a critical system
failure were to occur without timely recovery, SCE could be unable to fulfill critical business functions, such as delivery of electricity to customers and the ability to meter and bill customers all of which could materially affect SCE’s
ability to bill and collect fixed recovery charges or otherwise service the recovery property.

It may be difficult to collect fixed recovery charges from other parties who bill retail customers

Under California’s “direct access”
program, SCE faces competition in certain areas of its retail business from ESPs. Currently the direct access program is limited to 13,