Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Dec. 31, 2025

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes Integrated [Text Block]

ITEM 1C. CYBERSECURITY.

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the nation’s critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an evolving landscape.

To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are designed to follow nationally recognized frameworks. These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry’s risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.

Our approach to cybersecurity risk management includes the following key elements:

•Multi-Layered Defense and Continuous Monitoring: Our approach to cybersecurity involves multiple layers of defense, incorporating detection capabilities, analytics, and real-time monitoring. We utilize data insights to identify potential anomalies, monitor evolving threats, and identify emerging risks. Safeguards are regularly evaluated and refined based on vulnerability assessments, threat intelligence, and insights gained from monitoring activities.

•Information Sharing and Collaboration: We share and receive threat intelligence with industry peers, government agencies, Information Sharing and Analysis Centers ("ISACs"), trade organizations, and cybersecurity forums. These collaborations provide a means for information exchange to improve threat detection and vulnerability mitigation.

•Third-Party Risk Assessments: We engage independent firms to assist with multiple phases of our cybersecurity program. This work includes testing, audits, and consulting to validate and strengthen our cybersecurity posture, and the design and operational effectiveness of our controls.

•Companywide Policies and Procedures: Our companywide cybersecurity policies and procedures cover areas such as encryption standards, endpoint security, remote access protocols, multi-factor authentication, and data protection. These policies undergo regular review to address the latest security standards and operational requirements, and to consider best practices and industry trends.

•Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in simulated phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform tabletops and other exercises with management and incorporate external resources and advisors as needed. Our cybersecurity team collaborates with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.

•Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the

cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company’s engagement with such provider(s).

As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, critical business operations, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective in protecting our systems and information. As such, this could impact, among other considerations, the execution of our business strategy and business operations, our financial condition and/or results of operations, and the security and effectiveness of our information technology systems. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.

Cybersecurity Risk Board of Directors Oversight [Text Block]

Cybersecurity Risk Governance and Oversight

The Company’s BOD, in conjunction with its Audit Committee, oversees management’s approach to cybersecurity risk and its alignment with the Company’s enterprise risk management program. The BOD and Audit Committee receive reports from management regarding the prevention, detection, and mitigation of cybersecurity incidents, including security risks and vulnerabilities. Additionally, the Audit Committee receives updates on cybersecurity risk assessments, risk mitigation strategies, and relevant cybersecurity matters. The Company’s information technology team is responsible for developing and implementing its information security program and reporting on cybersecurity matters to the BOD and Audit Committee.

The Company’s Risk Management Committee ("RMC"), which is chaired by the Chief Risk Officer, evaluates risks relating to cybersecurity, among other significant risks, and oversees mitigation plans. The RMC is comprised of executive leadership across multiple functions, including individuals with responsibilities and oversight over legal, regulatory, finance and treasury, operations, information technology, business development, and policies and controls. The RMC meets monthly and receives regular updates on security performance metrics, global security risks, security enhancements, and updates on our security posture.

The Company has a cross-functional cybersecurity incident response team ("CIRT"). The Company’s CIRT routinely reviews and updates our incident response plans, procedures and protocols, as well as reports to the Company’s RMC on security matters that impact the confidentiality, integrity, or availability of the Company’s data or information systems.