CONSOLIDATED EDISON INC

The Companies are subject to cyber regulation by federal agencies, including FERC, the Transportation Security Agency and the Cybersecurity and Infrastructure Security Agency. The Utilities are subject to cyber regulation by the NYSPSC, that under the New York Public Service Law, is authorized to evaluate annually the utility’s customer privacy protections, including, but not limited to, customer electric and gas consumption data, and protection of critical energy infrastructure. In March 2023, the New York State legislature amended the New York State Public Service Law, directing the NYSPSC to develop rules to direct electric and gas utilities to, among other things, (i) protect customer privacy, including customer consumption data, from unauthorized disclosure; (ii) develop and implement tools to monitor operational control networks to detect unauthorized network behavior; and (iii) mandate that utilities’ emergency response plans include cyberattack response plans. In December 2024, the NYSPSC and the NYSDPS prepared a report on their review of New York gas and electric utilities’ compliance with the New York Public Service Law referenced above and their cybersecurity posture for operational and informational technology systems that manage operations and hold private customer data. The NYSPSC recommended adoption of specific cybersecurity regulations to enhance and codify standards and practices in these areas, which will be developed and implemented in a future proceeding. O&R’s subsidiary, RECO, is subject to cyber regulation by the NJBPU. See “The Companies Are Extensively Regulated And May Be Subject To Penalties” and "A Cyber Attack Could Adversely Affect the Companies" in Item 1A and Item 1C: Cybersecurity.