Company: POR
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000784977-25-000012
Chunk: 83

Company: PORTLAND GENERAL ELECTRIC CO /OR/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 83
---
 the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.

The Audit and Risk Committee of the Board of Directors has oversight of cybersecurity risk and receives briefings on a quarterly basis. The briefings are provided either by the cybersecurity team, together with a senior member of management, or are presented as part of the Audit and Risk Committee’s regular review of top enterprise risks, in which cybersecurity risk is reviewed annually or more frequently if circumstances warrant. The Audit and Risk Committee briefs the full Board of Directors at each meeting. In addition, the full Board of Directors has 

34

Table of Contents

participated in cybersecurity exercises. The Audit and Risk Committee is also provided with information about external assessment results and action plans. There is a process in place to notify the Audit and Risk Committee promptly in the event of a material cybersecurity incident.

PGE has a threat intelligence and insider risk program to stay abreast of emerging cybersecurity threats. The Company’s threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE’s Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and assessments.  In addition, cyber security resiliency is enhanced through regular functional and tabletop exercises. PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet the Company’s security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. The Company also has procured cybersecurity insurance.

All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices. 

PGE engages a third party to attempt to penetrate its systems periodically. These assessments support a continuous improvement initiative, ensuring ongoing enhancements to security posture. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.