Company: SREA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001032208-25-000012
Chunk: 106

Company: SEMPRA
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 106
---
 use data) to support state energy initiatives, increasing the risks of inadvertent disclosure or unauthorized access of sensitive information. Moreover, all our businesses operating in California (and in other states and countries that have similar laws) are subject to enhanced state privacy laws, which require companies that collect information about California residents to, among other things, disclose their data collection, use and sharing practices; allow consumers to opt out of certain data sharing with third parties; and assume liability for unauthorized disclosure of certain highly sensitive personal information.

Although we make significant investments in risk management, technology resiliency and information security measures for the protection of our systems and data, these measures could be insufficient or otherwise fail, particularly against attacks involving sophisticated adversaries, including nation-state actors, or outages involving key technology vendors. The costs and operational consequences of implementing, maintaining and enhancing these measures are significant and expected to increase to address evolving cyber risks. We often rely on third-party vendors to deploy new technologies and maintain and update our systems (including providing security updates), and these third parties may not have adequate risk management, technology resiliency and information security measures with respect to their systems or may fail to timely provide and install software updates. Although we have not experienced a material breach of our information systems or data, we and some of our vendors have been and will likely continue to be subject to breaches of and attempts to gain unauthorized access to our systems or data or efforts to otherwise disrupt our operations. Any actual or perceived noncompliance with applicable data privacy and security laws or any incidents impacting our or our vendors’ information systems; the integrity of the energy grid, our pipelines or our distribution, storage and other infrastructure; or our personal, sensitive and confidential information could result in disruptions to our business operations, regulatory compliance failures, inability to produce accurate and timely financial statements, energy delivery failures, financial and reputational loss, litigation, violations of applicable laws and fines or penalties, any of which could have a material adverse effect on our results of operations, financial condition, cash flows and/or prospects. Although Sempra currently maintains cyber liability insurance, this insurance is limited in scope and subject to exceptions, conditions and coverage limitations and may not cover the costs associated with a cybersecurity incident, and there is no guarantee that the insurance we currently maintain will continue to be available at rates we believe are reasonable.

We actively seek opportunities in the market through acquisitions, partnerships, JVs and divestitures.

We diligently analyze the financial viability of each acquisition, divestiture, partnership and JV we pursue. However, our