Company: CNLHP
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000072741-25-000007
Chunk: 32

Company: CONNECTICUT LIGHT & POWER CO
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 32
---
Item 1A. Risk Factors

In addition to the matters set forth under "Safe Harbor Statement Under the Private Securities Litigation Reform Act of 1995" included immediately prior to Item 1, Business, above, we are subject to a variety of material risks. Our susceptibility to certain risks, including those discussed in detail below, could exacerbate other risks. These risk factors should be considered carefully in evaluating our risk profile. There may be additional risks and uncertainties (either currently unknown or not currently believed to be material) that could adversely affect our financial position, results of operations, and cash flows.

Cybersecurity Threats and Attacks:

Cyberattacks, including acts of war or terrorism, targeted directly on or indirectly affecting our systems or the systems of third parties on which we rely, could severely impair operations, negatively impact our business, lead to the disclosure of confidential information and adversely affect our reputation.

Cyberattacks that seek to exploit potential vulnerabilities in the utility industry and seek to disrupt electric, natural gas and water transmission and distribution systems are increasing in sophistication, magnitude and frequency. Various geo-political conflicts and acts of war around the world continue to result in increased cyberattacks against critical infrastructure. A successful cyberattack on the information technology systems that control our transmission, distribution, natural gas and water systems or other assets could impair or prevent us from managing these systems and facilities, operating our systems effectively, or properly managing our data, networks and programs. The breach of certain information technology systems could adversely affect our ability to correctly record, process and report financial information. A major cyber incident could result in significant expenses to investigate and to repair system damage or security breaches and could lead to litigation, fines, other remedial action, heightened regulatory scrutiny and damage to our reputation.

We have instituted safeguards to protect our information technology systems and assets. We deploy substantial technologies to system and application security, encryption and other measures to protect our computer systems and infrastructure from unauthorized access or misuse. Specifically, regarding vulnerabilities, we patch systems timely where patches are available to deploy, and have technologies that detect exploits of vulnerabilities and proactively block the exploit when it happens. We also interface with numerous external entities to improve our cybersecurity situational awareness. The FERC, through the North American Electric Reliability Corporation (NERC), requires certain safeguards to be implemented to deter cyberattacks. These safeguards may not always be effective due to the evolving nature of cyberattacks. We maintain cyber insurance to cover damages, potential ransom and defense costs related to breaches of networks or operational technology, but it