Company: SREA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001032208-25-000012
Chunk: 589

Company: SEMPRA
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 589
---
ITEM 1C. CYBERSECURITY

CYBERSECURITY RISK MANAGEMENTSempra, SDG&E and SoCalGas have cybersecurity risk management processes in place that are intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. These cybersecurity risk management processes include cybersecurity incident response plans that are integrated into each entity’s respective enterprise risk management and emergency management programs. Our cybersecurity processes are largely designed and assessed based on the National Institute of Standards and Technology Cybersecurity Framework and the DOE’s Cybersecurity Capability Maturity Model standards. This does not imply that we meet any technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management processes include:

2024 Form 10-K  |  62

Table of Contents

▪risk assessments performed by internal personnel and third-party advisors designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environments▪information security teams principally responsible for developing and implementing (1) cybersecurity risk assessment processes, (2) information security controls, and (3) response plans to cybersecurity incidents▪the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our information security controls▪cybersecurity awareness training and policies designed to address social engineering attacks targeting employees and contractors▪cybersecurity incident response plans that include procedures for responding to and reporting, if applicable, certain cybersecurity incidents▪risk management processes for third-party service providers, suppliers, and vendorsWe have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our results of operations, financial condition, cash flows and/or prospects.

CYBERSECURITY GOVERNANCE

Sempra’s, SDG&E’s and SoCalGas’ respective boards of directors consider cybersecurity risk as part of their risk oversight function. The Sempra board of directors has delegated to its SST Committee, which is entirely composed of independent directors under the independence standards established by the NYSE, oversight of cybersecurity and other information and operational technology risks. The SST Committee reports to the Sempra board of directors regarding the Committee’s activities, including those related to cybersecurity. The SST Committee receives briefings on cybersecurity topics from Sempra’s chief information security officer, internal information security staff or external experts in part for continuing education on topics that impact public companies.