Company: SOJE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000092122-25-000018
Chunk: 4272

Company: SOUTHERN CO
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 4272
---
Item 1C.CYBERSECURITY.

Cybersecurity is a critical component of Southern Company's risk management program. The Southern Company system has implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the Southern Company system's ability to fulfill critical business functions, including energy delivery service failures, and on the confidentiality, integrity, and availability of the Southern Company system's information systems.

Governance and Oversight of Cybersecurity Risk

Board of DirectorsThe Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process. The Board devotes significant time and attention to overseeing cybersecurity risk, and the Southern Company system's approach to cybersecurity governance establishes oversight throughout the enterprise. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Business Security and Resiliency Committee (BSRC) of the Board. Having a committee like the BSRC, focused on and dedicated to security, is a strong governance practice. Comprised solely of independent members of the Board, the BSRC is charged with oversight of risks related to cybersecurity, physical security, and operational resiliency. The BSRC includes directors with an understanding of cyber issues. The BSRC meets at every regular Board meeting and when needed in 

I-27

    Table of Contents                                Index to Financial Statements

the event of a specific threat or emerging issue. The Chair of the BSRC regularly reports to the Board in connection with key matters the BSRC considered. The BSRC routinely receives presentations on a range of topics, including the threat environment and vulnerabilities and risks, policies, practices, technology trends, and regulatory developments, from the Chief Information Security Officer (CISO) and the legal organization and, as needed, the Chief Information Officer (CIO). The CISO reports to the BSRC at each regular committee meeting. Protocols have been established by which certain cybersecurity incidents are escalated internally and, where appropriate, reported to the BSRC, and ongoing updates regarding any such incident are provided until it has been resolved. See "Incident Response" herein.ManagementThe Southern Company system has implemented a cross-functional, risk-based, "defense-in-depth" approach to preventing, detecting, identifying, mitigating, responding to, and recovering from cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be