Company: SREA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001032208-25-000012
Chunk: 590

Company: SEMPRA
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 590
---
 The SST Committee as well as the SDG&E and SoCalGas boards of directors oversee management’s implementation of our cybersecurity risk management processes and receive regular reports from management on our material cybersecurity risks. In addition, management updates the SST Committee and SDG&E and SoCalGas boards of directors about certain cybersecurity incidents. The SDG&E and SoCalGas boards of directors receive briefings from SDG&E’s and SoCalGas’ chief information officer and internal information security staff. SDG&E’s and SoCalGas’ boards of directors also have safety committees that, at times, may oversee the matters described above on behalf of those companies’ respective boards of directors. We have formed cybersecurity councils to provide overall corporate oversight for managing material risks from cybersecurity threats. The cybersecurity councils meet regularly to receive updates on cybersecurity developments at Sempra and our consolidated entities from their cybersecurity management teams.Our cybersecurity management teams supervise efforts designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by information security tools deployed in the information technology environment. Cybersecurity management also supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Sempra’s director of cybersecurity governance & chief information security officer provides additional oversight and support for the operational cybersecurity activities at our consolidated entities.

Our cybersecurity materiality assessment teams, which include chief information security officers, chief information officers, chief risk officers, chief accounting officers or chief financial officers, and general counsels, help assess the materiality of certain cybersecurity incidents. The cybersecurity councils, cybersecurity management teams and materiality assessment teams include members with decades of operational experience as cybersecurity professionals as well as management with decades of service in the areas of information and operational technology and legal, compliance, financial reporting and enterprise risk management. Some of these members hold relevant degrees and certifications that we believe enhance our ability to manage and respond to cybersecurity risks, including, among others, bachelor’s and/or master’s degrees in cybersecurity and computer science as well as certified information systems security professional, certified incident handler, and certified information security manager certifications.

2024 Form 10-K  |  63