KINDER MORGAN INC

High-Risk Facilities

The Department of Homeland Security, referred to in this report as the DHS, has regulatory authority over security at certain high-risk chemical facilities. The DHS has promulgated the Chemical Facility Anti-Terrorism Standards and requires all high-risk chemical and industrial facilities, including oil and gas facilities, to comply with the regulatory requirements of these standards. This process includes completing security vulnerability assessments, developing site security plans, and implementing protective measures necessary to meet DHS-defined, risk-based performance standards. The DHS has not provided final notice to all facilities that it determines to be high risk and subject to the rule; therefore, neither the extent to which our facilities may be subject to coverage by the rules nor the associated costs to comply can currently be determined, but it is possible that such costs could be substantial.

In response to ongoing cybersecurity threats affecting the pipeline industry, the DHS’s Transportation Security Administration, or TSA, has issued a series of security directives setting forth specific elements that owners and operators of certain “critical” pipelines must include in their cybersecurity planning and their reporting of any incidents. These security directives require, among other things, that identified pipeline owners comply with mandatory reporting measures; designate a cybersecurity coordinator; provide vulnerability assessments; ensure compliance with certain cybersecurity requirements; establish and implement a TSA-approved Cybersecurity Implementation Plan; develop and maintain a Cybersecurity Incident Response Plan (CIRP), which shall include individuals identified as active participants in CIRP exercises, and annually test at least two CIRP objectives; and establish a Cybersecurity Assessment Plan (CAP), and annually submit an updated CAP to TSA for review and approval, which shall include a schedule for assessing and auditing specific cybersecurity measures for effectiveness.

In addition, PHMSA requires reporting of certain events that involve a release from or the shutdown of a pipeline, including those that may be caused by a cyber-attack. On July 26, 2023, the SEC adopted new disclosure requirements regarding cybersecurity risk management, strategy, governance, and incidents. Please read Item 1C. “Cybersecurity.” Regulations are also under development to implement reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), a law concerning the reporting of cyber incidents and ransomware payments that is expected to take effect in 2024.