Company: AWK
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001410636-25-000022
Chunk: 99

Company: American Water Works Company, Inc.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 99
---
 The CISO serves on the Water Sector Coordinating Council (“WSCC”), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CISO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CISO is also the former Chair of the WSCC, the National Association of Water Companies’ Safety and Security Committee, and the ASIS Utility Security Council. The CISO reports directly to the Company’s Chief Technology and Information Officer, who is responsible for the Company’s information technology program.The Company’s security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company’s operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company’s physical assets, business systems and operational technologies. The Company’s security team also conducts annual and ongoing cybersecurity awareness training and education for the Company’s employees. In 2024, 100% of the Company’s active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.The Company’s cybersecurity risk assessment process involves considering risks associated with the nature of its business, receiving and processing inputs from internal and external stakeholders, monitoring industry trends and risks and engaging external advisors, to assist in aligning the Company’s cybersecurity processes with industry best practices. Risk assessments are conducted quarterly and annually to evaluate the effectiveness of the Company’s existing security controls and serve as the basis for additional safeguards, security controls and measures. Operational and technical security controls are deployed and integrated as safeguards against unauthorized access to the Company’s information systems. These controls are aimed at (i) assuring the continuity of business processes that are dependent upon automation, (ii) maintaining the integrity of the Company’s data, (iii) supporting regulatory and legislative compliance requirements, and (iv) maintaining safe and reliable service to the Company’s customers. 

The Company has also implemented a vulnerability assessment program that is reviewed at least annually and more frequently, depending on changes to the risk environment. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company’s cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company’s internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and