Company: TSLTF
Filing Date: 2025-12-12
Form Type: SUPPL
Source: 0001193125-25-317786
Chunk: 317

Company: TRANSALTA CORP
Filing Date: 2025-12-12
Form: SUPPL
Chunk 317
---
 confidential or personal information of the Company, its customers, partners or others with whom the Company has dealings. Cyberattackers may use a range of techniques, from exploiting vulnerabilities within our user base (social engineering attacks), to using sophisticated malicious code on a single or distributed basis to try to breach our network security controls. We anticipate that the cyber threat landscape will continue to evolve, with increasing threats of ransomware, compromised insider threats, supply chain attacks, advanced targeted phishing and artificial intelligence. Cyber threats originate from various sources and vectors, from nation states, organized hacking groups or malware/ransomware. The cyber threat landscape continues to evolve, as we see cyber threats shift their focus from traditional attacks against perimeter information technology systems, to more effective attacks, such as phishing and ransomware. A successful cyberattack may allow for the unauthorized interception, destruction, use or dissemination of proprietary, confidential or personal information and may cause disruptions to our operations. As information technology /operation technology systems are integral to TransAlta’s business operations, the risk of a cybersecurity incident threatens the safety of the public, TransAlta personnel and/or business functions, service delivery, reputation and profitability. We are subject to regulatory, legislative and business requirements (e.g., North American Electric Reliability Corporation Critical Infrastructure Protection, SOX, Privacy) and also adopt industry endorsed standards and frameworks (e.g., National Institute of Standards and Technology, Critical Infrastructure Projection/Reliability Standards) as they pertain to our cybersecurity program and the implementation of our cybersecurity controls and processes. While we have cyber insurance, as well as systems, policies, procedures, practices, hardware, software applications and data backups designed to prevent or limit the effect of security breaches of our network and infrastructure, there can be no assurance that these measures will be sufficient and that such security breaches will not occur or, if they do occur, that they will be adequately addressed in a timely manner. TransAlta has established a comprehensive cybersecurity program to manage cybersecurity risks through effective security practices and structured and tailored plans. TransAlta maintains compliance to regulatory, legislative, and business requirements (e.g., NERC CIP, SOX, Privacy) by adopting industry-endorsed standards and frameworks (e.g., National Institute of Standards and Technology (NIST), CIP/Reliability Standards) to implement a pragmatic fit-for-purposecybersecurity program, implementing cybersecurity controls and processes under the following domains:

| • |     | Identify: TransAlta conducts comprehensive risk assessments to identify and document the 
 organization’s assets, systems and