Company: SCE-PL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000827052-25-000022
Chunk: 193

Company: SOUTHERN CALIFORNIA EDISON Co
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 193
---
 supply chain, and that the risks may escalate during periods of heightened geopolitical tensions.

SCE requires the uninterrupted use of sophisticated information and operational technology systems and infrastructure to monitor and operate the electric grid. In the regular course of SCE’s business, it also handles a range of sensitive infrastructure, security, employee, customer, and business systems information. If SCE's information technology and operational technology systems' security were to be compromised by physical or electronic means or a critical system or technology failure were to occur without timely recovery, including failure of new technology to be implemented as designed, SCE could be unable to fulfill critical business functions and/or sensitive information could be misappropriated or compromised. Such events could result in violations of privacy and other laws, material financial loss to SCE and/or to its customers, loss of confidence in SCE's security risk management, customer dissatisfaction, and significant litigation and/or regulatory exposure, all of which could materially affect Edison International’s and SCE's financial condition, operations, and the business reputation of Edison International and SCE.

SCE's security program cannot prevent all attacks or incidents 

SCE's systems have experienced, and will continue to face, cyber and physical security events involving malicious code, unauthorized access attempts, vandalism and other illicit activities. No security program can completely shield its systems, infrastructure, and data from attacks, intrusions, or other catastrophic events that could result in their failure or reduced functionality. There is no guarantee that SCE's security program, including prevention, detection, mitigation, and remediation of risks, will prevent all future cyber and physical security incidents that could materially impact its operations or financial condition.

SCE is not able to anticipate and prevent all physical and cyber attacks or information security breaches, and its investments in security resources, talent, and business practices may not be effective against all threat actors, particularly nation-state actors. Voluntary cybersecurity guidelines and practices cannot be applied to all businesses equally due to system capability, complexity, and resources for implementation. SCE's security tools and controls, including those supporting configuration management, identity and access management, network segmentation, and boundary defenses, may not fully protect against unauthorized access from internal and external threats. SCE's current security controls and defenses may also not protect against insider threats, including deliberate and unintentional actions (e.g., human error) and other emerging cybersecurity risks created by artificial intelligence, quantum computing, cyber skills shortages, and regulatory constraints. 

SCE's security program is prioritized based on known risks, available resources, and regulatory requirements, and therefore all SCE assets are not equally protected.