Company: SOJE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000092122-25-000018
Chunk: 4274

Company: SOUTHERN CO
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 4274
---
 and other technical evaluations.

Risk Management and StrategyAlthough many of the networks are segmented, overall network security is a centralized shared service across the Southern Company system, led by the TSO and the CISO. Recognizing that no single technology, process, or business control can effectively prevent or mitigate all risks related to cyber threats, multiple technologies, processes, and controls, all working independently but as part of a cohesive strategy, are employed to reduce risk. Southern Company system exposure and defenses are regularly tested through auditing, penetration testing, vulnerability testing, and other exercises designed to assess effectiveness.The Southern Company system emphasizes both security and resiliency through business assurance and incident response plans designed to identify, evaluate, and remediate incidents when they occur. A 24/7 security operations center is also utilized, which facilitates real-time situational awareness across the cyber-threat environment, and a robust insider threat protection program that leverages cross-function information sharing to assess insider threat activity is employed. The Southern Company system regularly reviews and updates its plans, policies, and technologies and conducts regular training exercises and crisis management preparedness activities to test their effectiveness. In addition, a security awareness program for the Southern 

I-28

    Table of Contents                                Index to Financial Statements

Company system's employees has also been implemented, which is designed to educate and train employees at least annually, or more often as needed, about risks inherent to human interaction with information and operational technology.The Southern Company system's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with both the Electricity Information Sharing and Analysis Center and the Downstream Natural Gas Information Sharing and Analysis Center, the Southern Company system benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps to allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, the Southern Company system also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.Many cybersecurity policies and standards across the Southern Company system are governed by multiple regulatory requirements. Portions of these policies and standards are audited by the FERC, the Transportation Security Administration, and the NRC, as appropriate, and are periodically evaluated by third parties such as cybersecurity insurance carriers. Certain members of senior management have high-level security clearances to facilitate access to critical information