The rely on evolving and complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties to support a variety of business processes and activities, including procurement and supply chain, invoicing and collection of payments, customer relationship management, human resource management, the acquisition, generation and delivery of electrical service to customers, and to process financial information and results of operations for internal reporting purposes and to comply with regulatory financial reporting and legal and tax requirements. The use their systems and infrastructure to create, collect, store, and process sensitive information, including personal information regarding customers, employees and their dependents, retirees, and other individuals. Their systems are vulnerable to disability, failures or unauthorized access caused by natural disasters, cybersecurity incidents, security breaches, user error, unintentional defects created by system changes, military or terrorist actions, nation-state threat actors, criminal organizations, power or communication failures or similar events. Any such failure could have a material adverse impact on the ' ability to process transactions and provide service, as well the ' financial condition and results of operations. Further, a data breach involving theft, improper disclosure, or other unauthorized access to or acquisition of confidential information could subject the to penalties for violation of applicable privacy laws, claims by third parties, and enforcement actions by government agencies. A data breach could also reduce the value of proprietary information, and harm the reputation of the .
Private and public entities, such as the North American Electric Reliability Corporation, and the U.S. federal government, including the Departments of Defense, Homeland Security and Energy, and the White House, have noted that cyberattacks targeting utility systems are increasing in sophistication, magnitude, and frequency. The Utilities' systems have been, and will likely continue to be, a target of attacks. Further, the Utilities' operational networks may be subject to unforeseen operational/cybersecurity risks due to the reliance on legacy operational components or modernizing and interconnecting existing infrastructure with new technologies and control systems, including those owned by third parties, such as independent power producers, distributed energy resource aggregators and customers. Although the Utilities have not experienced a material cybersecurity breach to date, such incidents may occur and may have a material adverse effect on the Utilities and the Company in the future. The Utilities continue to make investments in their cybersecurity program, including personnel, technologies, cyber insurance and training of Utilities personnel; however, there can be no assurance that these systems or their expected functionality will be implemented, maintained, or expanded effectively; nor can security measures completely eliminate the possibility of a cybersecurity breach. The Utilities maintain cyber liability insurance that covers certain damages caused by cyber incidents. However, there is no guarantee that adequate insurance will continue to be available at rates the Utilities believe are reasonable or that the costs of responding to and recovering from a cyber incident will be covered by insurance or recoverable in rates. If the Utilities' operational technologies or networks were to malfunction or fail or cybersecurity measures were to be breached, the Utilities could suffer financial loss, business disruptions, liability to customers, regulatory intervention or damage to their reputations.
Due to the size, scope and complexity of the Utilities' business, the development and maintenance of information technology systems to process and track information is critical and challenging. The Utilities often rely on third-party vendors to host, maintain, modify, and update its systems and these third-party vendors could cease to exist, fail to establish adequate processes to protect the Utilities systems and information, experience supply chain compromises or other internal or external security incidents. In addition, the Utilities are pursuing complex business transformation initiatives, which include the implementation of new systems and the upgrade or replacement of existing systems. Significant system changes increase the risk of system interruptions, which may occur. Further, delay or failure to complete the integration of information systems and processes may result in delays in regulatory cost recovery, or the failure to realize the benefits anticipated to be derived from these initiatives.
The Utilities' disaster recovery plans may not be successful in preventing the loss of customer data, service interruptions and disruptions to operations or damage to important facilities. If any of these systems fail to operate properly or become disabled and the Utilities' disaster recovery plans do not effectively resolve the issues in a timely manner, the Utilities could suffer financial loss, business disruptions, liability to customers, regulatory intervention or damage to their reputations, any of which could have a material adverse effect on the Utilities' and the Company's financial condition and results of operations.