EDISON INTERNATIONAL

Successful attacks on SCE information and operational technology systems and infrastructure could have a material impact on SCE's operations or financial condition

Edison International and SCE systems, assets and personnel are targets for physical and cyber attacks. Regulators such as NERC and U.S. Government agencies, including the Departments of Defense, Homeland Security, and Energy, have increasingly stressed that threat sources, including nation-state actors, continue to seek to identify and exploit vulnerabilities in the U.S. national electric grid and other critical energy infrastructures, and that such attacks and disruptions, both physical and cyber, are highly sophisticated and dynamic. Several U.S. Government agencies have highlighted the increasing risks related to physical and cybersecurity attacks, including ransomware attacks, related to the electric sector, including its supply chain, and that the risks may escalate during periods of heightened geopolitical tensions.

SCE requires the uninterrupted use of sophisticated information and operational technology systems and infrastructure to monitor and operate the electric grid. In the regular course of SCE’s business, it also handles a range of sensitive infrastructure, security, employee, customer, and business systems information. If SCE's information technology and operational technology systems' security were to be compromised by physical or electronic means or a critical system or technology failure were to occur without timely recovery, including failure of new technology to be implemented as designed, SCE could be unable to fulfill critical business functions and/or sensitive information could be misappropriated or compromised. Such events could result in violations of privacy and other laws, material financial loss to SCE and/or to its customers, loss of confidence in SCE's security risk management, customer dissatisfaction, and significant litigation and/or regulatory exposure, all of which could materially affect Edison International’s and SCE's financial condition, operations, and the business reputation of Edison International and SCE.

SCE's security program cannot prevent all attacks or incidents

SCE's systems have experienced, and will continue to face, cyber and physical security events involving malicious code, unauthorized access attempts, vandalism and other illicit activities. No security program can completely shield its systems, infrastructure, and data from attacks, intrusions, or other catastrophic events that could result in their failure or reduced functionality. There is no guarantee that SCE's security program, including prevention, detection, mitigation, and remediation of risks, will prevent all future cyber and physical security incidents that could materially impact its operations or financial condition.

SCE is not able to anticipate and prevent all physical and cyber attacks or information security breaches, and its investments in security resources, talent, and business practices may not be effective against all threat actors, particularly nation-state actors. Voluntary cybersecurity guidelines and practices cannot be applied to all businesses equally due to system capability, complexity, and resources for implementation. SCE's security tools and controls, including those supporting configuration management, identity and access management, network segmentation, and boundary defenses, may not fully protect against unauthorized access from internal and external threats. SCE's current security controls and defenses may also not protect against insider threats, including deliberate and unintentional actions (e.g., human error) and other emerging cybersecurity risks created by artificial intelligence, quantum computing, cyber skills shortages, and regulatory constraints.

SCE's security program is prioritized based on known risks, available resources, and regulatory requirements, and therefore all SCE assets are not equally protected. For example, not all of SCE's information technology assets are inventoried, which could result in unmitigated vulnerabilities or slow the detection, investigation, and recovery of an incident. Known vulnerabilities in SCE's information technology and operational technology environments may not be remediated before an adversary could discover or exploit them. Attackers can also exploit new, unknown vulnerabilities (e.g., zero day) and vulnerabilities where a patch or other remediation measure is not yet available.

SCE's transition to a more network-connected grid and increased deployment of new technologies increases the number of systems adversaries can target

SCE's operations require the continuous availability and deployment of critical information and operational technology systems, sensitive customer and employee data and infrastructure information, all of which are targets for malicious actors. New cyber and physical threats arise as SCE moves to an increasingly digital electric grid. For example, SCE's grid modernization efforts and the transition to a more connected grid, including the integration of new technologies and increased networking of operational technology assets such as substations, increases the threat surface and potential vulnerabilities that an adversary can target. As new systems are developed or procured by SCE, software development practices may not comprehensively prevent the introduction of new software vulnerabilities. Additionally, certain existing or legacy information technology, operational technology, and communications infrastructure use less secure protocols or configurations.

Vendors and other third parties may be used to target and attack SCE

SCE interacts with a wide array of third parties and depends on vendors to provide it with products and services. These products and services may contain vulnerabilities and could require patching which could cause disruptions to SCE's operations. Malicious actors may attack vendors to disrupt the services they provide to SCE, or to use those vendors as a conduit to attack SCE. SCE system data and architecture are also disclosed, either voluntarily or by mandate, to third parties and the public by regulators, employees, contractors, and vendors. This system data may be used by malicious actors to understand SCE’s systems to prepare for a cyber or physical attack.

The products and services provided by SCE's vendors may contain vulnerabilities or otherwise not adhere to SCE's enterprise cybersecurity standards (e.g., lack of encryption). Additionally, SCE's operational technology vendors have increasingly been targeted by threat actors. A compromise of equipment and/or exfiltration of SCE data, whether by physical or by electronic means, could result in loss or changes to confidential or sensitive information and interruption of business processes. For example, compromises to widely-used products and services may affect the supply chains of many industries, including companies in SCE’s supply chain. While SCE vendors have experienced cybersecurity incidents, such incidents have not, to SCE's knowledge, resulted in a material impact to SCE to date.