Company: AWK
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001410636-25-000022
Chunk: 98

Company: American Water Works Company, Inc.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 98
---
 to potential compromises of sensitive Company information through third parties and reevaluates these risks periodically. In addition, the Company obtains annual attestation reports related to data security and privacy from certain third-party providers to further support compliance with industry-standard cybersecurity protocols.Cybersecurity RisksCybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and information technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving and increasingly complex nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. By way of example, as previously disclosed, on October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems, which was determined to be the result of a cybersecurity incident. To date, the Company has determined that it has not experienced a cybersecurity incident that has resulted in a material impact to the Company’s financial condition, results of operations, cash flows, or business strategy. For additional information concerning the October 3, 2024, cybersecurity incident, and cybersecurity-related risks, see Item 1A—Risk Factors—Risks Related to Our Industry and Business Operations—We are, and may in the future be, subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured; and Item 7—Management’s Discussion and Analysis of Financial Condition and Results of Operations—Other Matters—Cybersecurity Incident.

36

Table of Contents

Cybersecurity Risk Management and StrategyThe Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company’s Chief Information Security Officer (“CISO”), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company’s internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The CISO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company’s Chief Security Officer, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International.