Company: SCE-PL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000827052-25-000022
Chunk: 70

Company: SOUTHERN CALIFORNIA EDISON Co
Filing Date: 2025-02-27
Form: 10-K
Item: Item 7
Chunk 70
---
 management, identity and access management, network segmentation, and boundary defenses, may not fully protect against unauthorized access from internal and external threats. SCE's current security controls and defenses may also not protect against insider threats, including deliberate and unintentional actions (e.g., human error) and other emerging cybersecurity risks created by artificial intelligence, quantum computing, cyber skills shortages, and regulatory constraints. 

SCE's security program is prioritized based on known risks, available resources, and regulatory requirements, and therefore all SCE assets are not equally protected. For example, not all of SCE's information technology assets are inventoried, which could result in unmitigated vulnerabilities or slow the detection, investigation, and recovery of an incident. Known vulnerabilities in SCE's information technology and operational technology environments may not be remediated before an adversary could discover or exploit them. Attackers can also exploit new, unknown vulnerabilities (e.g., zero day) and vulnerabilities where a patch or other remediation measure is not yet available. 

SCE's transition to a more network-connected grid and increased deployment of new technologies increases the number of systems adversaries can target

SCE's operations require the continuous availability and deployment of critical information and operational technology systems, sensitive customer and employee data and infrastructure information, all of which are targets for malicious actors. New cyber and physical threats arise as SCE moves to an increasingly digital electric grid. For example, SCE's grid modernization efforts and the transition to a more connected grid, including the integration of new technologies and increased networking of operational technology assets such as substations, increases the threat surface and potential vulnerabilities that an adversary can target. As new systems are developed or procured by SCE, software development practices may not comprehensively prevent the introduction of new software vulnerabilities. Additionally, certain existing or legacy information technology, operational technology, and communications infrastructure use less secure protocols or configurations.

41

Table of Contents

Vendors and other third parties may be used to target and attack SCE

SCE interacts with a wide array of third parties and depends on vendors to provide it with products and services. Malicious actors may attack vendors to disrupt the services they provide to SCE, or to use those vendors as a conduit to attack SCE. SCE system data and architecture are also disclosed, either voluntarily or by mandate, to third parties and the public by regulators, employees, contractors, and vendors. This system data may be used by malicious actors to understand SCE’s systems to prepare for a cyber or physical attack.

The products and services provided by SCE's vendors may contain vulnerabilities or otherwise