Centerpoint Energy (CNP) Risk Analysis

We are subject to cyber and physical security risks related to our information technology systems, operational technology, network infrastructure and other technology and facilities used to conduct almost all of our businesses. The operation of our electric transmission, distribution and generation systems is dependent on the physical interconnection of our facilities, as well as communications among the various components of our systems and the systems of supply chain stakeholders (such as vendors, contractors and suppliers). Further, certain of the various internal systems we use to conduct our businesses are highly integrated. Consequently, a cyberattack or unauthorized access in any one of these systems could potentially impact the other systems. Similarly, our business operations, including our transmission systems and natural gas pipelines, are part of an interconnected system. Disruption of those systems, or our ability to communicate with those systems, whether caused by physical disruption such as storms or other natural disasters, by failure of equipment or technology or by man-made events, such as cyberattacks or acts of terrorism, may disrupt our ability to conduct operations and control assets, lead to operational interruptions and negatively impact our business. The sophistication of cybersecurity threats, including those leveraging AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency, such as AI and cloud-based infrastructure, may further expose our computer systems to the risk of cybersecurity incidents. Also, remote working arrangements could increase our data security risks, including loss of data related to sensitive customer, employee, financial and operating system information, through insider or outsider actions. Cyberattacks, including deep fakes (which are increasingly more difficult to identify as fake), phishing, smishing, vishing or quishing attacks and threats from the use of malware, ransomware and viruses or malicious code, and unauthorized access could also result in the loss, or unauthorized use, of confidential, proprietary or critical infrastructure data or security breaches of other information technology systems that could disrupt operations and critical business functions, adversely affect our reputation, impact our customers, increase costs and subject us to possible legal claims and liability. While we have implemented and maintain a cybersecurity program designed to protect our information technology, operational technology, and data systems from such attacks, our cybersecurity program does not prevent all breaches or cyberattack incidents. Publicly known vulnerabilities in our information technology and operational technology environments may not be remediated before an adversary could discover or exploit them. Attackers can also exploit new, unknown vulnerabilities (e.g., zero-day vulnerabilities) and vulnerabilities where a patch or other remediation measure is not yet available. The data that we disclose to, and services we receive from, third parties may be subject to cybersecurity risks associated with threats to third-party systems. These risks include security compromises, vulnerabilities or failures related to the technologies and systems used by service providers, other supply chain stakeholders and/or governmental entities. The potential impact of such threats depends in part on the criticality of the third-party services and/or extent of access these third parties have to our confidential information and/or systems. We have experienced an increase in the number of attempts by external parties to access our networks or our company data without authorization. We have also experienced, and expect to continue to experience, cyber intrusions and attacks to our information systems and those of third parties, including supply chain stakeholders and government entities who perform certain services for us or administer and maintain our sensitive information. These prior intrusions and attacks have not had a material impact on our business, financial condition, results of operations and cash flows. Because technology is increasingly complex and cyberattacks are increasingly sophisticated and more frequent, there is a risk such incidents could have an adverse effect on us in the future. The risk of a disruption or breach of our operational technology systems, or the compromise of the data processed in connection with our operations, through a cybersecurity breach or ransomware attack, has increased as attempted attacks have advanced in sophistication and number around the world. Although CenterPoint Energy currently maintains cybersecurity insurance, this insurance is limited in scope and subject to exceptions, conditions and coverage limitations and may not cover the costs associated with potential cybersecurity incidents, and there is no guarantee that the insurance that CenterPoint Energy currently maintains will continue to be available at rates we believe are reasonable. Our continued efforts to integrate, consolidate and streamline our operations have also resulted in increased reliance on current and recently completed projects for technology systems and may increase potential vulnerabilities and points of failure in our information and operations systems. A failure to maintain and enhance existing information technology systems, or the failure of new technology systems to be implemented as designed, could adversely affect our operations. Procedures we implement to protect our systems may be insufficient to protect and safeguard against unauthorized access to secured data. A failure of our technologies or procedures, or our inability to support and integrate these technologies across our subsidiaries, could materially and adversely impact our operations, diminish customer confidence and our reputation, materially increase the costs we incur to protect against these risks and subject us to possible financial liability or increased regulation or litigation. We depend on the secure operations of our physical assets to transport the energy we deliver and our information technology to process, transmit and store electronic information, including information and operational technology we use to safely operate our energy transportation systems. Companies in our industry face a heightened risk of exposure to and have experienced acts of terrorism and vandalism. Our electric and gas physical infrastructure may be targets of physical security threats or terrorist activities. Further, recent escalation with respect to geopolitical conflicts may increase the likelihood that facilities within the United States, including natural gas distribution systems or electric transmission, distribution or generation systems that we own or on which we rely, will be targeted by strikes, acts of terrorism or cyberattacks. Security breaches, attacks on our infrastructure and facilities, including against the Registrants or as a means to harm a third party by disrupting the transmission and distribution of energy, acts of terrorism, including by foreign or domestic actors, and vandalism could expose our business to a risk of loss, misuse or interruption of critical physical assets or information and functions that affect our operations, as well as potential data privacy breaches and loss of protected personal information and other sensitive information, such as Critical Energy Infrastructure Information. Such losses could result in operational impacts, damage to our assets, public or personal safety incidents, impacts to our customers, damage to the environment, reputational harm, competitive disadvantage, increased regulation and regulatory enforcement actions, litigation and a potential adverse effect on our business, financial condition, results of operations and cash flows. There is no certainty that costs incurred related to actual or thwarted cyberattacks, or for the safeguarding against such security threats, will be recoverable through rates.

Our revenues and results of operations are subject to seasonality, weather conditions and other changes in electricity and natural gas usage, as applicable. Houston Electric's revenues are generally higher during the warmer months. As in certain past years, unusually mild weather in the warmer months could diminish Houston Electric's results of operations and harm its business, financial condition and cash flows. Conversely, as in certain past years, extreme warm weather conditions could increase Houston Electric's results of operations in a manner that would not likely be annually recurring. A significant portion of Indiana Electric's sales are for space heating and cooling. Consequently, as in certain past years, Indiana Electric's results of operations may be adversely affected by warmer-than-normal heating season weather or colder-than-normal cooling season weather, while, as has occurred in certain past years, more extreme seasonal weather conditions could increase Indiana Electric's results of operations in a manner that would not likely be annually recurring. Revenues in our Natural Gas reportable segment are customarily higher during the winter months. As in certain past years, unusually mild weather in the winter months could diminish our results of operations and harm our business, financial condition, results of operations and cash flows. Conversely, as occurred in certain past years, extreme cold weather conditions could increase our results of operations in a manner that would not likely be annually recurring.

A changing climate creates uncertainty and could result in broad changes, both physical and financial in nature, to our service territories and our business. Our facilities and operations face physical risks from severe weather events, natural disasters and other climate-related conditions, which have become more frequent, unpredictable and severe as a result of climate change or other factors. Severe weather events, natural disasters and other climate-related conditions impact our service territories, primarily when hurricanes and remnants of hurricanes, tornadoes, floods, severe winter weather conditions, including ice storms, wildfires, thunderstorms, high winds, hail, derecho events, microbursts, drought, excess humidity or extreme temperatures (high heating/cooling days) occur, which can impact our operations and our ability to serve our customers, including resulting in operational interruptions and large-scale and/or prolonged outages. To the extent the frequency and severity of extreme weather events, natural disasters and climate-related conditions such as rising sea level and coastal erosion continue to increase, our costs of providing service may increase, including the costs and availability of procuring insurance related to such impacts, and those costs may not be recoverable. In addition, our insurance may not be sufficient or effective under all circumstances and against all related hazards or liabilities to which we may be subject. Any losses for which we are not fully insured or that are not covered by insurance at all could adversely affect our business, financial condition, results of operations and cash flows. A delay or failure in recovering amounts for storm restoration costs incurred, inability to securitize future storm restoration costs, or loss of revenues as a result of severe weather could have a material impact on us, including lower credit ratings and, thus, higher costs for future debt issuances, as well as limitations on our ability to fund other investments to address customer needs. The implementation of budget and spending cuts to federal government agencies and programs could also impact our operations and our ability to serve customers when such weather events, natural disasters and other climate conditions occur, including increasing our costs. Further, events of extreme weather and natural disasters could make it unsafe or hinder the effectiveness of our employees to fix, maintain and restore power to affected areas and could harm our reputation. Since certain of our facilities are located along or near the Texas Gulf Coast, increased or more severe hurricanes, tornadoes or derecho events could increase our costs to repair damaged facilities and restore service to our customers.?Our electric and natural gas operations in our service territories have both been impacted by severe weather events, including the February 2021 Winter Storm Event, the May 2024 Storm Event and Hurricane Beryl, and could experience similar events in the future, which could have an adverse impact on our business, financial condition, results of operations and cash flows. Further, if climate changes occur?that result in fewer heating degree days than normal in our service territories, which has occurred in certain past years, financial results from our businesses could be adversely impacted. For example, where natural gas is used to heat homes and businesses, warmer weather might result in less natural gas being used, adversely affecting us. Severe weather events, natural disasters and the effects of climate change have increased the duration of wildfire season and may further exacerbate the possibility of wildfires and the risks related thereto, including that we may be held liable for damages incurred as a result of wildfires, reputational harm, damage to our network, facilities and systems resulting therefrom. While we proactively take steps to mitigate wildfire risk in the areas of our electrical and natural gas assets, wildfire risk is always present. We could be held liable for damages incurred as a result of wildfires or incur reputational harm if it was determined that they were caused by or enhanced due to any fault of CenterPoint Energy. Wildfires could also jeopardize our electric and natural gas infrastructure, including Houston Electric's and Indiana Electric's vast network of electric transmission and distribution lines and facilities and CERC's natural gas distribution systems, and third-party property and result in temporary or prolonged power outages and shortages in our service territories. Wildfires also have the potential to negatively affect communities in our service territories and the surrounding areas, and the continued expansion of the wildland-urban interface has increased this wildfire risk. In addition, while we maintain wildfire insurance, our insurance may not be sufficient to cover all losses we may incur as a result of wildfires. Wildfires could also lead to significant financial distress, credit rating downgrades and further increased costs for wildfire insurance or lack of availability thereof. Insufficient wildfire insurance coverage, increased wildfire insurance costs and a lack of wildfire insurance availability could adversely impact our business, financial condition, results of operations and cash flows. Furthermore, any damage caused to our assets, loss of service to our customers, liability imposed, credit rating downgrades or regulatory recovery risk occurring as a result of wildfires could negatively impact our business, financial condition, results of operations and cash flows. We are subject to transition risk relating to climate change, as well. In the long term, climate change could cause shifts in population, including customers moving away from our service territories. When we cannot deliver electricity or natural gas to customers or our customers cannot receive our services, our financial results are impacted by lost revenues, and we generally must seek approval from regulators to recover restoration costs.?To the extent we are unable to recover those costs or recover in a timely manner, or if recovery of such costs results in higher rates and reduced demand for our services, our future financial results may be adversely impacted. Similarly, public and private efforts to address climate change, such as by legislation, regulation, actions by private interest groups, and litigation, could impact our ability to continue operating our businesses as we do today, significant aspects of which rely on fossil fuels. These initiatives could have a significant impact on us and our operations as well as on our third-party suppliers, vendors and partners, which could impact us by among other things, causing permitting and construction delays, project cancellations or increased project costs passed on to us. We also may be subject to climate change litigation, which could result in substantial fines, penalties or damages and restrictions on our operations. The utility industry has already faced such litigation, challenging its marketing and use of fossil fuels and attributing climate change to emissions resulting from the use of fossil fuels. While we have pursued and executed, and continue to pursue and execute, on plans to accelerate investments to enhance the resiliency of our systems to better withstand severe weather, natural disasters, and other climate-related impacts, these plans are generally subject to approval by regulators and may not be approved in full or at all. Certain accelerated resilience plans of the Registrants have received regulatory approval for a limited scope and duration, generally at levels less than those proposed to the regulators. We may not be able to successfully execute such plans and projects in the time and manner planned and there are risks regarding the ability to demonstrate the efficacy of the accelerated resilience investments in mitigating storm impacts, as well as in seeking and obtaining regulatory approval for additional accelerated resilience plans and projects that may be necessary. The need for this investment and these expenditures could cause execution, liquidity, capital or other financing-related risks as well as result in upward pressure on our customer rates, which, particularly when combined with upward pressure resulting from the recovery of the costs of recent and future storms, may result in adverse actions by applicable regulators or effectively limit our ability to make other planned capital or other investments. The occurrence of extreme weather events, including winter storms and record hot temperatures, or other causes could also lead to additional reforms to the Texas electric market, some measure of which, if implemented, could have an adverse impact on Houston Electric. For example, during and in the aftermath of the February 2021 Winter Storm Event, the Texas legislature revised applicable statutes and granted the PUCT and ERCOT additional regulatory authority, both oversight and enforcement, that focuses on ensuring ERCOT market participants, including Houston Electric, have adopted sufficient winterization standards and protection. If any additional protections are required in the future as a result of additional extreme weather events or other causes, complying with these new protections may increase the cost of electricity, which could adversely affect Houston Electric's business, financial condition, results of operations and cash flows.