Company: SOJE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000092122-25-000018
Chunk: 4275

Company: SOUTHERN CO
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 4275
---
, and the Southern Company system participates in pilot programs with industry and the U.S. government to share additional information and strengthen cybersecurity and business resiliency.The Southern Company system also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, or customer or otherwise implicating the third-party technology and systems used. Among other things, the Southern Company system has established a Vendor Security Incident Working Group to address such third-party security incidents, including following up with the third party as appropriate and taking steps to mitigate any impact to systems. The Vendor Security Incident Working Group includes members of the internal cybersecurity teams to address any incidents that may invoke the CIRP. Additionally, the Southern Company system typically imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to the Southern Company system's data and systems. The Southern Company system also maintains insurance coverage for cyber incidents; the scope of coverage and fitness of coverage is evaluated each year.Incident ResponseThe Southern Company system has adopted a CIRP that applies in the event of certain cybersecurity threats or incidents to provide a standardized guide for responding to security incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the incident response process follows the National Institute of Standards and Technology guidance and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. The CIRP is reviewed periodically to help ensure its applicability to any changing needs or circumstances and to provide users a tactical tool to effectively respond to incidents. The CIRP applies to all Southern Company system personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Southern Company system information and to all devices and network services that are owned or managed by the Southern Company system. A full tabletop exercise is performed at least annually, including stakeholders from business units beyond technology security, such as power delivery, legal, compliance, risk management, and corporate communications. In addition, the Southern Company system participates in sector-level and cross-sector exercises led by industry or the U.S. government. In the event of an incident, the technology security organization, the legal organization, and other stakeholders frequently review lessons learned after an incident has been remediated.

Material Cybersecurity Risks, Threats,