Company: SCE-PL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000827052-25-000022
Chunk: 509

Company: SOUTHERN CALIFORNIA EDISON Co
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 509
---
 and Technology (NIST) Cybersecurity Framework (CSF) as a guideline to identify, evaluate and manage material risks from cybersecurity threats. SCE also engages consultants, and coordinates with the Federal government and industry peers, to assist in identifying, evaluating and managing its cybersecurity risks, and uses contractual terms to establish cybersecurity requirements with certain third parties. Identified cybersecurity risks are documented and presented to management to review and advise on cybersecurity strategies and mitigation measures. Based on management reviews, cybersecurity strategies and remediation plans are developed or adjusted to address pertinent risks. Edison International and SCE leverage training, policies, technical and procedural controls, and mitigation plans to address risks from cybersecurity threats. Management has established a cybersecurity oversight group comprised of a multidisciplinary senior management team, including its Vice President of Enterprise Risk Management, to monitor and provide strategic direction for the prevention, detection, mitigation, and remediation of risks from cybersecurity threats. A Boards of Directors’ liaison regularly attends meetings of the cybersecurity oversight group and provides reports to the Safety and Operations Committees of the Boards of Directors. Other members of the Boards of Directors are invited to attend meetings and typically attend at least one meeting annually. The Edison International and SCE Audit and Finance Committees of the Boards of Directors oversee enterprise risk management, including risks from cybersecurity threats. Annually, Edison International and SCE’s enterprise risk management team conducts a review of enterprise risks, including risks from cybersecurity threats, and presents the results of its review to management and the Audit and Finance Committees. In addition, the Boards of Directors have assigned primary responsibility for cybersecurity operations oversight to the Edison International and SCE Safety and Operations Committees, which receive regular cybersecurity updates from SCE’s Chief Security Officer on specific topics, including the dynamic cybersecurity landscape and defense and risk mitigation strategies. To inform its oversight over cybersecurity threats, SCE’s Chief Security Officer also presents to the full Boards of Directors annually. The Boards of Directors also receive a periodic cybersecurity report from an external SCE consultant that includes an assessment of SCE's cybersecurity program and organization. SCE’s Chief Security Officer has primary responsibility for assessing and managing risks from cybersecurity threats, and serves as Edison International and SCE’s chief information security officer. SCE’s Chief Security Officer has extensive experience in the cybersecurity industry, including previous experience in cybersecurity roles at Southern Company, the MITRE Corporation, the National Institute of Standards and Technology (NIST), and the Federal Bureau of Investigation (FBI). SCE's Chief Security Officer earned a bachelor’s degree in computer information systems from Clemson University and is a Certified Information Systems Security Professional (CISSP). For additional information