Company: EAI
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000065984-25-000012
Chunk: 828

Company: ENTERGY ARKANSAS, LLC
Filing Date: 2025-02-18
Form: 10-K
Item: Item 7
Chunk 828
---
 Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy’s management is responsible for managing cybersecurity risk.  Entergy and the Registrant Subsidiaries’ security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program.  The first line of defense, comprised of business units performing operational functions, including the CISO and CIO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities.  The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense.  Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office.  The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.Entergy’s CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence.  The CSO’s background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company.  The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in 

316

Table of ContentsPart I Item 1A, 1B, and 1CEntergy Corporation, Utility operating companies, and System Energy

the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I).  The CSO participated in numerous exercises and crisis operations during his time in the military.  The CSO is a member of the Information Systems Audit and Control Association and a certified Information