Company: TSLTF
Filing Date: 2025-12-12
Form Type: SUPPL
Source: 0001193125-25-317786
Chunk: 287

Company: TRANSALTA CORP
Filing Date: 2025-12-12
Form: SUPPL
Chunk 287
---
-agency training events at our facilities. This ensures continuous improvement and familiarity with our assets and builds strong communication channels for emergency response. Our processes designate how we communicate with stakeholders in the event of a crisis. This is managed by our Crisis Communications Team. The team has the responsibility and goal to provide a unified message on behalf of the Company throughout the response and recovery, ensure all messaging is approved by the Incident

Commander, co-ordinatemessaging with any applicable external agencies and, if necessary, deploy them to an incident site. Annual training, exercise and drill requirements are adhered to by our employees operating at our facilities. The results are tracked, audited and presented at our annual executive review. The findings and recommendations assist in maintaining an effective program across the organization. Data and Digital Asset Protection We work diligently to protect our digital assets, including our corporate data and our digital identities that provide access into line of business applications. Cybersecurity threats that compromise these assets include the manipulation of data integrity, system and network hacking, use of social engineering tactics through email phishing and compromise of operations and infrastructure through the use of ransomware, credential breaches and attacks introduced through unknowing third-party vendors and service providers. Given the ever-evolving nature of cyberattacks, we are continuously adapting our cybersecurity program to focus on three key pillars: technology, processes and people. Each of these pillars can be reinforced independently to address specific cybersecurity risks and threats through a comprehensive and multi-faceted program. TransAlta continually assesses our cyber threat and risk levels through independent auditing and simulated cyber-attacks (i.e., penetration testing). Results from these assessments and exercises guide our cybersecurity strategy and practices, implementing measures and controls to proactively mitigate internal and external cybersecurity risks and threats posed to the organization. TransAlta’s Cybersecurity Policy defines how we identify and manage cybersecurity risks and threats, as well as how we detect, respond, and recover from cybersecurity incidents. We comply with all relevant legal, regulatory, industry standards and compliance requirements such as the North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP), the Australian Security of Critical Infrastructure Act and the U.S. Sarbanes Oxley Act, where applicable. The NERC CIP and Australian Security of Critical Infrastructure rules are a set of standards aimed at regulating, enforcing, monitoring and managing the security of the North American and Australian power system. These compliance standards apply specifically to address cybersecurity risks. In 2024, there were no identified cybersecurity breaches to our technology environment. Refer to Cybersecurity Risk in