Company: PCG-PB
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001004980-25-000010
Chunk: 33

Company: PG&E Corp
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 33
---
 by a cyber incident, cybersecurity breach, or physical attack.” in Item 1A. Risk Factors.

54

Governance

PG&E Corporation’s and the Utility’s Boards of Directors, particularly their Safety and Nuclear Oversight Committees, have primary responsibility for overseeing cybersecurity risk management, including reviewing the companies’ cybersecurity policies, controls, and procedures.  The Safety and Nuclear Oversight Committees participate in cybersecurity risk reviews to promote alignment in operations and asset management in the implementation of mitigation strategies designed to reduce the risk and impact of cybersecurity threats.  In the event that the Safety and Nuclear Oversight Committees identify significant exposures, including with respect to cybersecurity, they communicate such exposure to the Boards of Directors to assess PG&E Corporation’s and the Utility’s risk identification, risk management, and mitigation strategies.  Management provides briefings to the Safety and Nuclear Oversight Committees at least annually, as well as briefings on important cybersecurity incidents and threats as necessary and appropriate or as requested.  These briefings include describing cybersecurity threats, defenses, mitigation strategies, and risk data analytics that may impact the companies’ significant assets.

The Executive Vice President and Chief Information Officer of PG&E Corporation and the Utility and the Senior Vice President, Chief Security Officer, and Chief Data and Analytics Officer of the Utility have collectively over 50 years of prior work experience in various roles involving information technology and cybersecurity functions.  They are responsible for assessing and managing cybersecurity risks in collaboration with the enterprise risk management team.  Such persons are informed about cybersecurity vulnerabilities and incidents through daily and weekly operating reviews conducted by management and personnel closest to the work as part of the Lean operating system and as otherwise appropriate.