Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
• Incident Response. We maintain a Cybersecurity Operations Center that is dedicated to monitoring for cybersecurity threats to our systems and responding to potential cybersecurity incidents. We also maintain cybersecurity incident response plans that establish a cross-functional incident response team and processes to guide our response to cybersecurity incidents, including processes for reporting and escalating cybersecurity incidents to senior management and the Audit Committee or the Board, as appropriate. We conduct tabletop exercises annually to test our incident response processes.
Read in the filing ↗ Also in 10-K of Feb 19, 2026
The Company has incurred, and expects to continue to incur, certain expenses related to the Incident and its response to the Incident. The Company maintains customary cybersecurity insurance coverage and believes this insurance will offset related costs.
Read in the filing ↗
As described in Item 1A “Risk Factors,” our operations rely on the secure processing, storage, and transmission of confidential, sensitive, and other information within our computer systems and networks. Computer viruses, threat actors, employee or vendor incidents, and other external hazards could expose our information systems, and those of third parties who process our data, provide access to systems, or that have access to our systems, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, reputation, results of operations and financial condition, and subject us to possible legal claims and liability. While we have experienced cybersecurity incidents in the past, as of the date of the filing of this Form 10-K, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us, including our business strategy, results of operations, or financial condition.
Read in the filing ↗ Also in 10-K of Feb 19, 2026
The sophistication of cybersecurity threats, including those leveraging AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency, such as AI and cloud …
Read in the filing ↗ Also in 10-K of Feb 20, 2025
Our Audit Committee, comprised of independent directors from our Board, oversees the Board’s responsibilities relating to CenterPoint Energy’s cybersecurity, data privacy and AI programs, including cybersecurity and AI risk management and cybersecurity disclosures required by applicable securities laws or regulations, as appropriate. As part of its risk oversight responsibilities, the Audit Committee receives quarterly reports from our Executive Vice President and General Counsel, Chief Security Officer (CSO) or other representatives from our cybersecurity or data privacy groups and periodic reports from our third-party consultants. These reports include updates on certain cybersecurity or data privacy matters, including, among other items, CenterPoint Energy’s progress in maturing its cybersecurity program, results of cybersecurity assessments and testing, the cybersecurity landscape and emerging threats, status of ongoing initiatives and strategies, incident reports and learnings from any cybersecurity events, compliance with regulatory requirements and industry standards, data privacy matters, and the cybersecurity budget.
Read in the filing ↗ Also in 10-K of Feb 20, 2025
CenterPoint Energy’s CISO joined the Company in September 2024 and has over two decades of experience serving in multiple global leadership roles in cybersecurity, as well as technology and industrial systems at a Fortune 500 global industrial company, for which he was responsible for, among other things, building and maintaining enterprise programs relating to cybersecurity and managing cybersecurity risk. Our Executive Vice President and General Counsel has significant risk management, governance and litigation experience, which we believe are important leadership skills to help incorporate risk management, legal, disclosure and governance perspectives into the design of our cybersecurity program and in evaluating and responding to potential cybersecurity incidents.
Read in the filing ↗
We maintain a cybersecurity program to help us assess, identify, and manage cybersecurity risks to our systems and data, including to help us defend against and mitigate emerging and existing cybersecurity threats to our information technology and operational technology systems. Our strategies and processes for managing cybersecurity risks are informed by relevant industry frameworks and laws, regulations and standards applicable to us in the jurisdictions in which we do business, including those applicable to utilities that operate bulk electric systems or critical pipeline facilities. We maintain various policies, procedures, technologies and other controls to help prevent, detect, mitigate and manage cybersecurity threats and incidents. We also use third-party consultants and service providers to support our risk management efforts, such as services for cybersecurity intelligence, monitoring, testing and assessments.
Read in the filing ↗ Also in 10-K of Feb 19, 2026
In September 2026, CenterPoint Energy, Inc. (the “Company”) became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information. Upon becoming aware of the post, the Company promptly took action and activated its cybersecurity incident response protocols, initiated an investigation with the assistance of third-party cybersecurity experts, and took steps to further protect the Company’s systems.
Read in the filing ↗
CenterPoint Energy’s CSO joined CenterPoint Energy in September 2025 and has over two decades of experience in cybersecurity and risk management across diverse industries, and most recently served in senior leadership roles, including Chief Information Security Officer, for a global engineering, procurement, consulting and construction company. Our Executive Vice President and General Counsel has significant risk management, governance and litigation experience, which we believe are important leadership skills to help incorporate risk management, legal, disclosure and governance perspectives into the design of our cybersecurity program and in evaluating and responding to potential cybersecurity incidents.
Read in the filing ↗
such costs incurred will be recovered through rates. We also face increasing and evolving disclosure and reporting obligations related to cybersecurity events, and there is no certainty that we will be able to meet existing or future disclosure obligations and avoid the risk of potentially having our disclosures misinterpreted when made. National security or public safety considerations may further affect, or in some instances prevent, our public disclosure of a cybersecurity incident in certain circumstances. Any failure to remain in compliance with these government regulations or failure in our cybersecurity protective measures may result in enforcement actions which may have an adverse effect on our business, financial condition, results of operations and cash flows.
Read in the filing ↗
attacks, our cybersecurity program does not prevent all breaches or cyberattack incidents. Publicly known vulnerabilities in our information technology and operational technology environments may not be remediated before an adversary could discover or exploit them. Attackers can also exploit new, unknown vulnerabilities (e.g., zero-day vulnerabilities) and vulnerabilities where a patch or other remediation measure is not yet available …
Read in the filing ↗
• catastrophic events such as fires, earthquakes, explosions, leaks, floods, droughts, hurricanes, tornados, derecho events, ice storms, terrorism, cybersecurity incidents, wildfires, public health emergencies (including pandemics), acts of war, military invasions, civil unrest, geopolitical conflict or other similar occurrences, including any environmental impacts related thereto, which catastrophic events may require participation in mutual assistance efforts by us or other utilities to assist in power restoration efforts, and for which our emergency preparedness plans may not be adequate or we may not respond effectively, which could result in public or employee harm.
Read in the filing ↗
… National security or public safety considerations may further affect, or in some instances prevent, our public disclosure of a cybersecurity incident in certain circumstances. Any failure to remain in compliance with these government regulations or failure in our cybersecurity protective measures may result in enforcement actions which may have an adverse effect on our reputation, financial condition, results of operations …
Read in the filing ↗
… Important factors that could cause actual results to differ materially from those indicated by the provided forward-looking information include risks and uncertainties relating to (1) the timing and nature of any remediation expenses incurred in connection with the Incident, (2) the availability of cybersecurity insurance proceeds, (3) the extent of regulatory compliance obligations, (4) the risk that the scope …
Read in the filing ↗
… Our actual or perceived ability to prevent, mitigate, prepare for and timely respond to electric outages, natural gas leaks or events and related accidents and similar interruptions caused by severe weather, physical or cybersecurity incidents or other unanticipated events, as well as our own or third parties’ actions or failure to act, can affect customer, regulator and legislator satisfaction or …
Read in the filing ↗
… The speed with which we are able to respond effectively to electric outages, natural gas leaks or events and related accidents and similar interruptions caused by severe weather, physical or cybersecurity incidents or other unanticipated events, as well as our own or third parties’ actions or failure to act, can affect customer, regulator and legislator satisfaction. For example, various federal …
Read in the filing ↗