Company: MSEX
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001174947-25-000251
Chunk: 389

Company: MIDDLESEX WATER CO
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 389
---
ITEM 1C.CYBERSECURITY

Cybersecurity Program

The Company’s cybersecurity program is an
integral element of the Company's overarching strategic plan and risk management system. The robustness of the cybersecurity initiatives
directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology
Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures
to safeguard its operational environment and data integrity systems.

The Company continually evaluates and refines
its cybersecurity program in response to key factors such as evolving threat landscapes, program maturation, gap analysis, and guidance
from external security consultants. The Company’s cybersecurity program relies on three key pillars: People, Process and Technology
(PPT) to deliver a robust cybersecurity program. The cybersecurity program includes various aspects of PPT, including, but not limited
to:

    ●
    Technology: Encryption, threat management, backups, monitoring, investigative support utilizing artificial intelligence embedded tools;

    ●
    Identity and Access Control Management Tools: Multi-factor authentication, monitoring and alerting of privilege account access;

    ●
    Cybersecurity Processes: Vulnerability scanning, penetration testing, and periodic assessments conducted by external security consultants;

    ●
    Incident Response Training: Regularly assessed incident response preparedness through various incident response and disaster recovery exercises; and

    ●
    Cyber Risk Awareness and Training: Frequent simulation exercises to heighten awareness of cybersecurity threats and educate our user community on preventative measures and reporting protocols.  All employees participate in required periodic training with respect to cybersecurity risk and risk mitigation.

17 

Our Chief Technology Officer (CTO), with over
25 years of experience in various disciplines of information technology, oversees the cybersecurity program. Reporting to the Chief Executive
Officer, the CTO provides regular briefs to the Board of Directors (the Board) and executive management, informing them about prevention,
detection, mitigation, and remediation of cybersecurity incidents, as well as ongoing risks and threats.

In our industry, the continuous functioning of
information systems is of the utmost importance. Leveraging information technology systems, we collect, process and safeguard sensitive
data and utilize automated tools to operate our plants.

Cybersecurity threats encompass potential hazards
such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks. These risks have the potential
to lead to information technology system failures, threat to water supply, or compromise of sensitive information.

Our cybersecurity