XML 54 R31.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Sep. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
The Company’s Enterprise Risk Assessment process, performed by management annually, is designed to identify significant risks relevant to the Company and to determine both their potential impacts and the rate at which the risk may manifest. Cybersecurity is among the top-tier risks identified in our risk assessment. Risk mitigation efforts are embedded in the Company’s operating procedures, internal controls and information systems.

The Company periodically examines its cybersecurity measures, including information technology controls, information security maturity assessments and operating effectiveness. These assessments can be performed through third-party assessments, penetration tests or internal assessments. Assessment results are reported to the Audit Committee and the Board of Directors, and the Company may make modifications to its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and reviews.

Key components of our cybersecurity risk management program include:
risk assessments designed to help identify cybersecurity risks to our critical systems, information, services and broader technology environment;
the use of external service providers with specific expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes;
evaluating our cybersecurity capabilities and, where appropriate, implementing effective, up-to-date technologies and processes to enhance them;
mandatory cybersecurity awareness training for our employees, including incident response personnel and senior management, as well as periodic experiential learning through phishing simulations;
risk assessments of third-party suppliers and the incorporation of cybersecurity contractual stipulations in our supplier contracts if deemed necessary;
physical security around sensitive infrastructure and critical cyber systems; and
intelligence sharing about emerging threats through collaboration with peer companies and government intelligence agencies.
Enterprise-wide, proactive cybersecurity risk mitigation is imperative to the Company. The Company’s cybersecurity efforts and programs align with the National Institute of Standards and Technology’s Cybersecurity Framework and meet or exceed the requirements set forth by the BPU. We also utilize the Cybersecurity Capability Maturity Model, or C2M2, from the U.S. Department of Energy to evaluate and improve our cybersecurity processes and programs for our critical infrastructure.

The information set forth under Part I, Item 1A. Risk Factors - Risks Related to Technologies of this Annual Report on Form 10-K is hereby incorporated by reference. As of September 30, 2025, our financial position, results of operations, cash flows or business strategy have not been materially affected by risks from cybersecurity threats. However, the Company cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
The Company’s Enterprise Risk Assessment process, performed by management annually, is designed to identify significant risks relevant to the Company and to determine both their potential impacts and the rate at which the risk may manifest. Cybersecurity is among the top-tier risks identified in our risk assessment. Risk mitigation efforts are embedded in the Company’s operating procedures, internal controls and information systems.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity risk oversight is a responsibility of the Board of Directors. The Board of Directors, through the Audit Committee, provides oversight for matters related to the security of information technology systems and procedures, including data privacy and cybersecurity and related risks.
The Audit Committee oversees the Company’s security risk management practices, including overseeing the practices, procedures, and controls that management uses to identify, assess, respond to, remediate, and mitigate risks related to cybersecurity. Senior leadership, including the Senior Vice President and CIO, updates the Audit Committee and the Board of Directors at least quarterly regarding cybersecurity risks, strategies and policies.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee oversees the Company’s security risk management practices, including overseeing the practices, procedures, and controls that management uses to identify, assess, respond to, remediate, and mitigate risks related to cybersecurity.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Managing Director of Information Security chairs this committee, which is responsible for:
establishing cybersecurity policies and standards that align with our corporate objectives and regulatory requirements;
monitoring compliance with cybersecurity policies and standards across the organization;
ensuring that cybersecurity strategies are integrated with the organization’s overall governance structure;
reviewing and approving significant cybersecurity investments and initiatives;
providing guidance on cybersecurity risk tolerance levels and ensuring that cybersecurity risks are communicated to the Audit Committee and Board of Directors; and
facilitating cross-departmental collaboration to address cybersecurity challenges and responses.
Cybersecurity Risk Role of Management [Text Block]
The Company’s management is responsible for identifying, managing and mitigating cybersecurity risk and communicating cybersecurity risks facing the Company to the Audit Committee and Board of Directors.

As part of its cybersecurity risk management program, the Company leverages its cybersecurity organization, led by the Company’s Managing Director of Information Security, to design and implement cybersecurity controls and to assess and report on cybersecurity risks. Members of the cybersecurity organization hold relevant degrees or industry-recognized certifications in cybersecurity, with relevant work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. The members of the cybersecurity organization are expected to keep their knowledge, skills and training current by participating in industry events and continuing education programs as applicable.

The Company also maintains an internal, cross-functional Cyber Resiliency Committee, which includes members of senior management from Information Technology, Cybersecurity, Enterprise Risk Management, Internal Audit, Corporate Communications, Legal, Finance and Corporate Physical Security. The Managing Director of Information Security chairs this committee, which is responsible for:
establishing cybersecurity policies and standards that align with our corporate objectives and regulatory requirements;
monitoring compliance with cybersecurity policies and standards across the organization;
ensuring that cybersecurity strategies are integrated with the organization’s overall governance structure;
reviewing and approving significant cybersecurity investments and initiatives;
providing guidance on cybersecurity risk tolerance levels and ensuring that cybersecurity risks are communicated to the Audit Committee and Board of Directors; and
facilitating cross-departmental collaboration to address cybersecurity challenges and responses.

Through ongoing engagement with these internal teams and certain third-party service providers, our CIO and our Managing Director of Information Security monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report on cybersecurity incidents. The Company has a notification process in our incident response plan that contains requirements for timely notification to senior management by the CIO and to the Board of Directors by the CEO for incidents that reach established thresholds as well as procedures for external reporting.

The Company’s Managing Director of Information Security has more than 25 years of cybersecurity experience throughout various industries, including the utility sector, and reports directly to the Company’s Senior Vice President and CIO. The Senior Vice President and CIO, who has over 30 years of work experience in the information technology field, is responsible for the Company’s information technology program and oversees the management and development of all business technology and security for the Company and its subsidiaries. The Senior Vice President and CIO is also responsible for compliance with applicable federal standards and critical infrastructure protection and reports to the Company’s President and CEO.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Company’s management is responsible for identifying, managing and mitigating cybersecurity risk and communicating cybersecurity risks facing the Company to the Audit Committee and Board of Directors.

As part of its cybersecurity risk management program, the Company leverages its cybersecurity organization, led by the Company’s Managing Director of Information Security, to design and implement cybersecurity controls and to assess and report on cybersecurity risks. Members of the cybersecurity organization hold relevant degrees or industry-recognized certifications in cybersecurity, with relevant work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. The members of the cybersecurity organization are expected to keep their knowledge, skills and training current by participating in industry events and continuing education programs as applicable.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Audit Committee oversees the Company’s security risk management practices, including overseeing the practices, procedures, and controls that management uses to identify, assess, respond to, remediate, and mitigate risks related to cybersecurity. Senior leadership, including the Senior Vice President and CIO, updates the Audit Committee and the Board of Directors at least quarterly regarding cybersecurity risks, strategies and policies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
The Company also maintains an internal, cross-functional Cyber Resiliency Committee, which includes members of senior management from Information Technology, Cybersecurity, Enterprise Risk Management, Internal Audit, Corporate Communications, Legal, Finance and Corporate Physical Security. The Managing Director of Information Security chairs this committee, which is responsible for:
establishing cybersecurity policies and standards that align with our corporate objectives and regulatory requirements;
monitoring compliance with cybersecurity policies and standards across the organization;
ensuring that cybersecurity strategies are integrated with the organization’s overall governance structure;
reviewing and approving significant cybersecurity investments and initiatives;
providing guidance on cybersecurity risk tolerance levels and ensuring that cybersecurity risks are communicated to the Audit Committee and Board of Directors; and
facilitating cross-departmental collaboration to address cybersecurity challenges and responses.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true