Company: ATO
Filing Date: 2025-11-14
Form Type: 10-K
Source: 0000731802-25-000056
Chunk: 48

Company: ATMOS ENERGY CORP
Filing Date: 2025-11-14
Form: 10-K
Item: Item 1C
Chunk 48
---
ITEM 1C.Cybersecurity.

We continuously assess our risk of cyber threats to adapt quickly to the ever-changing challenges and risks surrounding cybersecurity. Atmos Energy has implemented policies, procedures, and controls to identify, protect, detect, and respond to 

18

Table of Contents

cyberattacks or acts of online terrorism.  Atmos Energy is also subject to the U.S. Department of Homeland Security Transportation Security Administration (TSA) security directive for our natural gas pipeline monitoring and control systems.The potential impact of cybersecurity risks on our business operations, results of operations, or financial condition is discussed in the “Technology and Cybersecurity Risks” section of Item 1A “Risk Factors.” We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties, or settlement costs related to any cybersecurity breaches or incidents.  However, measures that we take to identify, protect, detect, and respond from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations, and financial condition in the future.The following describes our risk management and strategy and corporate governance as it pertains to cybersecurity.Risk Management and StrategyAtmos Energy’s cybersecurity program leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) in its design of controls intended to reduce the risk and potential impact of cybersecurity incidents. This comprehensive approach encompasses continuous monitoring, risk assessments, a cybersecurity incident response plan, and regular evaluations to align our practices with industry standards. Additionally, we actively engage in cybersecurity risk management practices and continually improve procedures and practices to support the continued safe and reliable delivery of natural gas to our customers. The identification and management of cybersecurity risk is a component of our Integrated Risk Management process, which applies adaptive process improvement to help us respond to the changing cybersecurity landscape. Additionally, we use third parties to enhance our collective capability to monitor, detect, and respond to cybersecurity incidents. Further, we maintain collaborative relationships with government officials, law enforcement, and industry peers to keep informed of trends and potential cyber tactics. Finally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.We have an information technology cybersecurity incident response plan to manage cybersecurity incidents. The plan provides guidelines for actions in response to cyber security incidents that may occur at or otherwise affect Atmos Energy. These guidelines include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team