XML 57 R33.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our cybersecurity policies are guided by standards or recommendations issued by, among others, the National Institute of Standards and Technology, the International Organization for Standardization, the NRC, and NERC. We deploy, configure, and maintain technologies and procedures designed to enforce security policies, detect and protect against cybersecurity threats, and help safeguard our material assets.
Our digital and cybersecurity controls are augmented with physical controls such as security systems, security site plans, security systems monitoring, and access control to mitigate physical security risks at our facilities. Our procurement policies and organizational controls require certain vendors to be assessed and vetted, with enhanced protocols on purchases and installations involving nuclear equipment. Additionally, cybersecurity reviews are performed on critical intellectual property vendors. Additionally, where warranted, we request a detailed cybersecurity questionnaire from our vendors to assess the vendor's practices and preparedness in addressing cyber threats.
Through a multi-functional coordinated effort, we assess and mitigate cybersecurity risks across our business units based on likelihood of the risk and potential impact to the business unit, the Company, and our stakeholders. These risks are identified using tactical, operational, and compliance-based approaches. Risks and associated consequences, should they materialize, are evaluated using likelihood of occurrence considering existing controls and technologies.
Our employees, as well as certain contractors, are required to complete cybersecurity awareness and training programs. Mandatory technical training is provided to employees and vendors performing, verifying, or managing cybersecurity activities. Mitigation efforts also include annual cyber crisis response simulations and annual training.
Third parties conduct periodic assessments on our cyber-related systems. To measure our non-nuclear cybersecurity framework maturity, we utilize internal and external audits and assessments, vulnerability testing, and governance processes. Our nuclear cybersecurity program is inspected biennially by the NRC and assessed annually by a quality assurance audit. Nuclear vulnerability management is implemented in collaboration with Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency.
We have cyber incident response plans to manage significant cybersecurity incidents across different aspects of our operations. Cybersecurity incidents are escalated based on significance to our Chief Administrative Officer, Chief Nuclear Officer, Chief Fossil Officer, General Counsel, Chief Financial Officer, Chief Executive Officer, Audit Committee, and (or) Board of Directors.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our cybersecurity policies are guided by standards or recommendations issued by, among others, the National Institute of Standards and Technology, the International Organization for Standardization, the NRC, and NERC. We deploy, configure, and maintain technologies and procedures designed to enforce security policies, detect and protect against cybersecurity threats, and help safeguard our material assets.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Periodic reports are given by senior management to the Audit Committee about material cyber events and our risk mitigation efforts.
Our senior executive team is responsible for the coordination of cybersecurity across the Company. Our cybersecurity teams, which include employees with appropriate professional certifications, are responsible for assessing and managing our cyber risk management protocols in their respective areas. These activities include the prevention, detection, mitigation, and remediation of material cybersecurity incidents as well as communicating risk management matters to key stakeholders. The cybersecurity teams have experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources. In coordination with our senior management, the relevant cybersecurity teams review risk management strategies to mitigate cybersecurity risks. Additionally, as needed, we engage specialists, consultants, auditors, and (or) other third parties to assist with assessing, identifying, and managing cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Periodic reports are given by senior management to the Audit Committee about material cyber events and our risk mitigation efforts.
Cybersecurity Risk Role of Management [Text Block]
Our senior executive team is responsible for the coordination of cybersecurity across the Company. Our cybersecurity teams, which include employees with appropriate professional certifications, are responsible for assessing and managing our cyber risk management protocols in their respective areas. These activities include the prevention, detection, mitigation, and remediation of material cybersecurity incidents as well as communicating risk management matters to key stakeholders. The cybersecurity teams have experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources. In coordination with our senior management, the relevant cybersecurity teams review risk management strategies to mitigate cybersecurity risks. Additionally, as needed, we engage specialists, consultants, auditors, and (or) other third parties to assist with assessing, identifying, and managing cybersecurity risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our senior executive team is responsible for the coordination of cybersecurity across the Company. Our cybersecurity teams, which include employees with appropriate professional certifications, are responsible for assessing and managing our cyber risk management protocols in their respective areas. These activities include the prevention, detection, mitigation, and remediation of material cybersecurity incidents as well as communicating risk management matters to key stakeholders.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our cybersecurity teams, which include employees with appropriate professional certifications, are responsible for assessing and managing our cyber risk management protocols in their respective areas. These activities include the prevention, detection, mitigation, and remediation of material cybersecurity incidents as well as communicating risk management matters to key stakeholders. The cybersecurity teams have experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Periodic reports are given by senior management to the Audit Committee about material cyber events and our risk mitigation efforts.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true