To learn more about risks facing the company, you can review the risks described in Item 1A. Risk Factors in the 2025 Annual Report on Form 10-K. The risks described in the 2025 Annual Report on Form 10-K are not the only risks facing the company. Additional risks and uncertainties also may materially adversely affect the company’s business, financial condition or results of operations in future periods.
Oversight of Succession Planning
The Board maintains a rigorous and ongoing process for management succession planning to ensure leadership continuity and sustained execution of the company’s long‑term strategy. Guided by our Corporate Governance Guidelines, the CEO is responsible for developing and maintaining a process to plan for successor chief executive officers, as well as for other key senior management positions. The CTD Committee, in collaboration with the independent Lead Director, reviews these succession plans for the CEO and other senior executives as part of its broader oversight of talent management. This review process is further reinforced through the Board’s annual self‑evaluation, which includes consideration of the effectiveness of succession planning and the Board’s opportunities to interact with other members of management.
As part of this process, the company amended and restated its Bylaws in June 2025 to clarify the process for the Board to designate successor officers in the case the office of any officer becomes vacant by reason of death, disability, resignation, removal, disqualification or otherwise.
Oversight of Technology and Cybersecurity Risk
Recognizing both existing information technology and emerging technologies as key risks for the company, the Board devotes significant time and attention to monitoring technology and reviewing data and systems protection, including cybersecurity and information security risk. The company uses a converged security model that brings together cybersecurity, physical security and threat intelligence within one department led by the Chief Security Officer, who joined the company from the Federal Bureau of Investigation after a more than 20-year career focused on criminal, counter-terrorism, counter-intelligence and cyber investigations. In 2025, the company created a new Chief Technology Officer role to focus specifically on how technology can be an accelerant to the company's mission of providing the reliable, affordable and increasingly clean energy that powers our customers every day. In 2026, we launched our Artificial Intelligence Policy, which emphasizes accountability, safety, validity, fairness, privacy and transparency in AI deployment and aligns AI use with our core values.
The Board, the Operations Committee, and when appropriate, the Audit Committee receive presentations and reports throughout the year on information technology, cybersecurity and information security risk from management, including the company’s Chief Administrative and Projects Officer, Chief Security Officer, Vice President of Cybersecurity, Chief Information Officer and Chief Technology Officer. These presentations and reports address a broad range of topics, including the development of the company’s technology plans, the company’s cyber risk management program, recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments, specific and ongoing efforts to prevent, detect and respond to internal and external critical threats and the company’s practical exercises with external federal, state and local incident response partners. In addition, the Board receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including assessments by independent consulting firms and legal counsel of our readiness and resilience.
Presentations to the Board and the appropriate Committees include updates on emerging technologies, like advanced forms of automation and artificial intelligence and the company’s plans for developing and implementing technological transformations.
With cyber tactics and strategies constantly evolving, our educational and refreshment processes are structured so that the Board can evaluate management’s and the company’s efforts to protect and preserve the confidentiality, integrity and availability of data and systems.
Management also has an executive Cyber Risk Council, which includes executive officers responsible for administrative services, corporate affairs, supply chain and corporate risk along with legal counsel and the corporate secretary. The company maintains a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan that provide clear direction for escalation of information to leadership, including to the Board as appropriate. To learn more about the company’s risk management, strategy and governance matters related to cybersecurity, review the information described in Item 1C. Cybersecurity in the 2025 Annual Report on Form 10-K.