Company: SOJE
Filing Date: 2025-04-11
Form Type: DEF 14A
Source: 0000092122-25-000036
Chunk: 30

Company: SOUTHERN CO
Filing Date: 2025-04-11
Form: DEF 14A
Chunk 30
---
 Operations,    
 Environmental  
 and Safety     
 Committee      |     | 4Reviews risks and associated risk management activities related to significant operations of the Southern Company system such as safety, system reliability, nuclear, gas and other operations, environmental regulation and policy, net zero carbon strategies, fuel cost and availability.                                                                                                                             |

Each committee provides ongoing oversight for each of our most significant risks designated to it, reports to the Board on their oversight activities and elevates review of risk issues to the Board as appropriate. Each committee has a designated member of executive management as the primary responsible officer for providing information and updates related to the significant risks for that committee. These officers ensure that all significant risks identified in the risk profile we develop are regularly reviewed with the Board and/or the appropriate committee(s).

Southern Company has a robust enterprise risk management program that facilitates identification, communication and management of the most significant risks throughout the Company, employing a formalized framework in which risk governance and oversight are largely embedded in existing organizational and control structures. As a part of the governance structure, the CFO serves as the Chief Risk Officer and is accountable to the CEO and the Board for ensuring that enterprise risk oversight and management processes are established and operating effectively.

#### 32Southern Company2025 Proxy Statement

#### Governance
All Directors are actively involved in the risk oversight function, and we believe that our leadership structure supports the Board’s risk oversight responsibility. Each committee is chaired by an independent Director, and the Chairman and CEO does not serve on any committee. There is regular, open communication between management and the Directors.

|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |     | Spotlight on Cybersecurity and Artificial Intelligence Risks |
| Cybersecurity is a critical component of our risk management program. The Board devotes significant time and attention to overseeing cybersecurity risk, and our approach to cybersecurity governance establishes oversight throughout the enterprise.                                                                                                                                                                                                                                                                                                                                                                            
 4The Business Security and Resiliency Committee, comprised solely of independent Directors, is charged with oversight of risks related to cybersecurity, physical security and operational resiliency. The Business Security and Resiliency Committee includes directors with an understanding of cyber issues. The Business Security and Resiliency Committee meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chief Information Security Officer reports to the Business Security and Resiliency Committee at each regular committee meeting.                      
 4We use a cross-functional, risk-based, and “defense in depth” approach to prevent, detect, identify, mitigate, respond to and recover from cybersecurity threats and