AVISTA CORP

The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency and we, along with other utility companies, are the target of these frequent attacks. In addition, there is a growing reliance on third party providers which are also subject to attacks and breaches. Any unexpected failure, or unauthorized access to technology systems or third parties relied upon can result in the unavailability of systems or services, which can result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. To date, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our results of operation or financial condition. See “Risk Factors – Cybersecurity Risk Factors” for further information regarding the risks we face from cybersecurity threats.

We consider the management of cybersecurity risk in our overall enterprise risk management process. See “Item 7. Management’s Discussion and Analysis - Enterprise Risk Management” for further discussion of the process.

We mitigate cyber risk by maintaining an enterprise security program based on the National Institute of Standards and Technology Cybersecurity Framework. This program includes trainings and exercises at all levels of the Company. Our security program incorporates enterprise business continuity which facilitates a business impact analysis of core functions for development of emergency operating and disaster recovery plans and coordinates annual testing and training exercises. In addition, there are independent third party and regulatory audits of our security program.

The cybersecurity risk management program is overseen by senior leadership within our Technology and Security functions. The program is led by the Senior Vice President of Operations and Technology and the Vice President, Chief Information and Security Officer. The Senior Vice President of Operations and Technology has more than 20 years of experience in information technology leadership, including roles directing enterprise systems and cybersecurity programs at other companies. The Vice President, Chief Information and Security Officer has over 15 years of experience at the Company, having served in engineering and technology leadership roles, including as the Director of Information Technology Infrastructure and the Director of Applications. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.

Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. Asubset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.

The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.