XML 29 R10.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk management and strategy

MGE manages its cybersecurity risk in accordance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Using the core functions of the NIST framework – identify, protect, detect, respond, recover, and governance – MGE employs a cybersecurity strategy program with input from its information technology (IT) leadership, senior management, and MGE Energy's Board of Directors (the Board). MGE maintains policies and procedures concerning cybersecurity matters, including those related to antivirus/malware protection, remote access, authentication, and confidential information. These policies go through an internal review process and are approved by appropriate executives and members of management.

 

Cybersecurity is considered within MGE's overall Enterprise Risk Management (ERM) program, which establishes an overall approach to enterprise risk management that can be consistently applied across the enterprise. As part of the ERM program, management identifies, assesses, mitigates, and monitors key enterprise risks. The ERM program includes evaluation of cyber risks' causes, impacts, ratings, and mitigations. Enterprise risks are reviewed and updated by management semi-annually.

 

MGE's IT Security team trains and collaborates across the organization along with outside partners and governmental agencies to maintain visibility and detection of continuously evolving threats and protection of MGE's digital systems. MGE has developed a security awareness program to help employees make sound security decisions through ongoing security awareness, education, and training activities. MGE has cyber incident response plans that detail identification, response, and recovery procedures in the event of a cyber incident. Periodic third-party penetration tests and vulnerability scans are performed both internally and externally to assess MGE's security measures and validate MGE's processes and procedures during a threat. In addition to assessing its own cybersecurity preparedness, MGE's security team also considers and evaluates cybersecurity risks associated with use of third-party service providers to confirm that security standards are met. MGE relies on third parties to deliver its products and services to customers, and a cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially impact MGE. Third-party cybersecurity controls are assessed through a cybersecurity questionnaire, and security and privacy addendums are included in contracts when applicable. Furthermore, at least annually vendor System and Organization Controls (SOC) 1 or SOC 2 reports are reviewed by internal business owners, if available. MGE's assessment of risks associated with use of third-party providers is part of the overall cybersecurity risk management framework. MGE has a cyber insurance policy to mitigate risk of financial damages. In an event of a material cyber incident, MGE engages representatives of the insurer in accordance with the cyber incident response plan.

Cybersecurity Risk Management Processes Integrated [Text Block]

Cybersecurity is considered within MGE's overall Enterprise Risk Management (ERM) program, which establishes an overall approach to enterprise risk management that can be consistently applied across the enterprise. As part of the ERM program, management identifies, assesses, mitigates, and monitors key enterprise risks. The ERM program includes evaluation of cyber risks' causes, impacts, ratings, and mitigations. Enterprise risks are reviewed and updated by management semi-annually.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

Enterprise-wide risk assessment and oversight are fundamental responsibilities of the Board, including cybersecurity. The Board, of which four members have technology and cybersecurity skills, is involved in the process of overseeing the primary risks faced in the conduct of our business. The Board receives, on an ongoing basis, information from management related to key business risks and mitigation strategies. These business risks include existing and emerging risks related to information technology systems and cybersecurity. Updates to the ERM risk register are provided to the Audit Committee of the Board semiannually, which includes a cybersecurity risk assessment. Annually, management presents the Company's cybersecurity strategy and initiatives to the Board. In addition, management provides quarterly cybersecurity updates to the Audit Committee to inform regarding any incidents, changes in risk or threat landscape, and provide any relevant information regarding trending topics in cybersecurity as it pertains to MGE Energy and its subsidiaries.

 

The Chief Financial Officer (CFO) & Treasurer and Chief Information Officer (CIO) are the system owners for electronic information and, in that capacity, are responsible for the processing, integrity, security, and availability of electronic information under their jurisdiction. The CFO has over 15 years of experience spanning several IT functions and levels of management, IT audit, applications development, project management, infrastructure and telecommunications, and cybersecurity. The CIO has over 25 years of IT experience, including ten years dedicated to cybersecurity in the utility, insurance, and financial sectors, and maintains a Certified Information Systems Security Professional (CISSP) certification. The CIO's cybersecurity experience includes engineering, architecture, incident response, and management.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board, of which four members have technology and cybersecurity skills, is involved in the process of overseeing the primary risks faced in the conduct of our business.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board receives, on an ongoing basis, information from management related to key business risks and mitigation strategies. These business risks include existing and emerging risks related to information technology systems and cybersecurity. Updates to the ERM risk register are provided to the Audit Committee of the Board semiannually, which includes a cybersecurity risk assessment. Annually, management presents the Company's cybersecurity strategy and initiatives to the Board. In addition, management provides quarterly cybersecurity updates to the Audit Committee to inform regarding any incidents, changes in risk or threat landscape, and provide any relevant information regarding trending topics in cybersecurity as it pertains to MGE Energy and its subsidiaries.
Cybersecurity Risk Role of Management [Text Block]

The Chief Financial Officer (CFO) & Treasurer and Chief Information Officer (CIO) are the system owners for electronic information and, in that capacity, are responsible for the processing, integrity, security, and availability of electronic information under their jurisdiction. The CFO has over 15 years of experience spanning several IT functions and levels of management, IT audit, applications development, project management, infrastructure and telecommunications, and cybersecurity. The CIO has over 25 years of IT experience, including ten years dedicated to cybersecurity in the utility, insurance, and financial sectors, and maintains a Certified Information Systems Security Professional (CISSP) certification. The CIO's cybersecurity experience includes engineering, architecture, incident response, and management.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Chief Financial Officer (CFO) & Treasurer and Chief Information Officer (CIO) are the system owners for electronic information and, in that capacity, are responsible for the processing, integrity, security, and availability of electronic information under their jurisdiction.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CFO has over 15 years of experience spanning several IT functions and levels of management, IT audit, applications development, project management, infrastructure and telecommunications, and cybersecurity. The CIO has over 25 years of IT experience, including ten years dedicated to cybersecurity in the utility, insurance, and financial sectors, and maintains a Certified Information Systems Security Professional (CISSP) certification. The CIO's cybersecurity experience includes engineering, architecture, incident response, and management.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] MGE's IT Security team trains and collaborates across the organization along with outside partners and governmental agencies to maintain visibility and detection of continuously evolving threats and protection of MGE's digital systems. MGE has developed a security awareness program to help employees make sound security decisions through ongoing security awareness, education, and training activities. MGE has cyber incident response plans that detail identification, response, and recovery procedures in the event of a cyber incident.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true