The Evergy Companies rely upon information technology networks and systems to process, transmit and store electronic information, and to manage or support a variety of business processes and activities, including the generation, transmission and distribution of electricity, supply chain functions and the invoicing and collection of payments from customers. The Evergy Companies also use information technology networks and systems to record, process and summarize financial information and results of operations for internal reporting purposes and to comply with financial reporting, legal and tax requirements. These networks and systems are in some cases owned or managed by third-party service providers. In the ordinary course of business, the Evergy Companies collect, store and transmit sensitive data including operating information, proprietary business information and personal information belonging to customers and employees.
The Evergy Companies' information technology networks and infrastructure, as well as the networks and infrastructure belonging to third-party service providers, are vulnerable to damage, disruptions or shutdowns due to attacks or breaches by hackers or other unauthorized third parties; error or malfeasance by employees, contractors or service providers; unintended consequences related to software or hardware upgrades, additions or replacements; malicious software code; vulnerabilities in third-party software code; telecommunication failures; the lack of availability of qualified employees and contractors; natural disasters or other catastrophic events; or criminal activity, terrorist attacks or acts of war. The Evergy Companies use technology to enable remote-working arrangements, which may increase or expose previously unknown vulnerabilities. Public reports have indicated an increase in cyberattacks in general due, in part, to the increase in the number of employees working remotely and the proliferation of the different ways in which people interact with their information technology infrastructure.
The occurrence of any of these events could, among other things, impact the reliability or safety of the Evergy Companies' generation, transmission and distribution systems and information systems; result in the erasure of data or render the Evergy Companies' equipment, or the equipment of third-party service providers, unusable; impact the Evergy Companies' ability to conduct business in the ordinary course; reduce sales; expose the Evergy Companies and their customers, employees and vendors to a risk of loss or misuse of information; result in legal claims or proceedings, liability or regulatory penalties; damage the Evergy Companies' reputation; or otherwise harm the Evergy Companies' results of operations, financial position and cash flows. The Evergy Companies can provide no assurance that they will be able to identify and remediate all security or system vulnerabilities or that unauthorized access or error will be identified and remediated.
The Evergy Companies are subject to laws and rules issued by multiple government agencies concerning cybersecurity and safeguarding their customer and business information. For example, NERC has issued comprehensive regulations and standards surrounding the security of the bulk power system, including both physical and cybersecurity, and continually evaluates the necessity for updates and new requirements with which the Evergy Companies must comply. The Evergy Companies are subject to recurring, independent, third-party audits with respect to adherence to these regulations and standards. The NRC also has issued regulations and standards related to the protection of critical digital assets at nuclear power plants. Compliance with NERC and NRC rules and standards, and rules and standards promulgated by other regulatory agencies from time to time or future legislation, will increase the Evergy Companies' compliance costs and their exposure to the potential risk of violations of these rules, standards or future legislation, which includes potential financial penalties. Furthermore, the non-compliance by other utilities subject to similar regulations or the occurrence of a serious security event at other utilities could result in increased regulation or oversight, both of which could increase the Evergy Companies' costs and adversely impact their financial results.
Additionally, the Evergy Companies cannot predict the impact that any future information technology or malicious attack may have on the energy industry in general. The electric utility industry, both within the United States and internationally, has experienced physical and cybersecurity attacks on energy infrastructure such as power plants, substations and related assets in the past, and there will likely be more attacks in the future. Geopolitical matters, including terrorist attacks and acts of war, may increase the likelihood of such attacks. The Evergy Companies have been subject to attempted cyber attacks from time to time, and will likely continue to be subject to such attempted attacks, but these prior attacks have not had a material impact on their operations. However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent, there can be no assurance that such incidents will not have a material adverse effect on the Evergy Companies in the future. The Evergy Companies' facilities and systems could be direct targets or indirect casualties of such attacks. The effects of such attacks could include disruption to the Evergy Companies' generation, transmission and distribution, and information systems or to the electrical grid in general, reduced sales and could increase the cost of insurance coverage. Furthermore, although the Evergy Companies maintain information security risk insurance coverage, such insurance may not be adequate to cover any associated losses. Any of the foregoing could have a material adverse impact on the Evergy Companies' results of operations, financial position and cash flows.