The Company uses technology in substantially all aspects of its business operations and requires uninterrupted operation of information technology and operation technology systems, including disaster recovery and backup systems and network infrastructure. These systems may be vulnerable to physical and cybersecurity failures or unauthorized access, due to hacking, human error, theft, sabotage, malicious software, ransomware, third-party compromise, acts of terrorism, acts of war, acts of nature or other causes. Emerging artificial intelligence driven threats, such as biased outputs, artificial intelligence assisted phishing, deepfakes, and malicious use of generative artificial intelligence could further increase cybersecurity and operational risk.
Should a compromise or system failure occur, interdependencies to technology may disrupt the Company's ability to fulfill critical business functions. This may include interruption of electric generation, transmission and distribution facilities, natural gas storage and pipeline facilities, any of which could adversely affect the Company's reputation, business, cash flows and results of operations or subject the Company to legal or regulatory liabilities and increased costs. Litigation expenses and damages for such an event can be significant. Additionally, the Company's electric generation and transmission systems and natural gas pipelines are part of interconnected systems with other operators' facilities; therefore, a cyber-related disruption in another operator's system could negatively impact the Company's business.
The Company's accounting systems and its ability to collect information and invoice customers for services could be disrupted. If the Company's operations are disrupted, it could result in decreased revenues and remediation costs that could adversely affect the Company's results of operations and cash flows.
The Company is subject to cybersecurity and privacy laws, regulations and security directives of many government agencies, including TSA, FERC, NERC, and state regulatory bodies. NERC issues comprehensive regulations and standards surrounding the security of bulk power systems and continually updates these requirements, as well as establishing new requirements with which the utility industry must comply. TSA cybersecurity directives for pipeline operators introduces heightened compliance obligations. As these regulations evolve, the Company may experience increased compliance costs and may be at higher risk for violating these standards. Experiencing a cybersecurity incident could cause the Company to be non-compliant with applicable laws and regulations, causing the Company to incur costs related to legal claims, proceedings and regulatory fines or penalties. Additionally, costs incurred to comply with cybersecurity directives or to remediate a cybersecurity incident may not be fully recoverable through customer rates. The SEC has adopted rules that require the Company to provide disclosures around cybersecurity risk management, strategy, and governance, as well as disclose the occurrence of material cybersecurity incidents. These rules may also require the Company to report a cybersecurity incident before the Company has been able to fully assess its impact or remediate the underlying issue. Efforts to comply with such reporting requirements could divert management's attention from the Company's incident response and could potentially reveal system vulnerabilities to threat actors. Failure to timely report incidents under these or other similar rules could also result in monetary fines, sanctions or subject the Company to other forms of liability. This regulatory environment is increasingly challenging and may present material obligations and risks to the Company's business, including significantly expanded compliance burdens, costs, and enforcement risks.
The Company, through the ordinary course of business, requires access to sensitive customer, supplier, employee and Company data. A breach of the Company's systems could compromise sensitive data and could go unnoticed for some time. Such an event could result in negative publicity and reputational harm, remediation costs, legal claims and fines that could have an adverse effect on the Company's financial results. Third-party service providers that perform critical business functions for the Company or have access to sensitive information within the Company also may be vulnerable to security breaches and information technology risks that could adversely affect the Company.
The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices, and work from home arrangements. Such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company.