Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases. All words must appear; put a phrase in "quotes".
Matching paragraphs
8 paragraphs · newest first, each linked to its filing
The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents to management and the Board of Directors. Once an incident meets certain criteria, the Company’s Cybersecurity Incident Command or, in the most severe cases that
Also in 10-K of Feb 25, 2026
impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident’s materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.
We develop and maintain systems and processes aimed at detecting and preventing information and cybersecurity incidents which require significant investment, maintenance, and ongoing monitoring and updating as technologies and regulatory requirements change. These systems and processes may be insufficient to mitigate the possibility of cybersecurity incidents, malicious social engineering, fraudulent or other malicious activities, and human error or malfeasance in the safeguarding of our data.
Also in 10-K of Feb 25, 2026
To date, we do not believe there have been risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Pinnacle West or APS. However, there is no assurance that will continue to be the case. If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions and our business strategy, results of operations, and financial condition could all be materially impacted. See the risk factor entitled, “We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition” in Item 1A - Risk Factors for more information.
To date, we do not believe there have been any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pinnacle West or APS. However, there is no assurance that will continue to be the case. If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions could be materially impacted, which could materially adversely affect our results of operations and financial conditions. See the risk factor entitled, “We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition” in Part I, Item 1A - Risk Factors for more information.
We maintain cyber insurance to provide coverage for a portion of the losses and damages that may result from a security breach of our information technology systems, but such insurance is subject to a number of exclusions and may not cover the total loss or damage caused by a breach. Coverage for cybersecurity events continues to evolve as the industry matures. In the future, adequate insurance may not be available at rates that we believe are reasonable, and the costs of responding to and recovering from a cyber incident may not be covered by insurance or recoverable in rates.
Also in 10-K of Feb 25, 2026
with which the utility industry must comply. The NRC also has issued regulations and standards related to the protection of critical digital assets at commercial nuclear power plants. The increasing promulgation of NERC and NRC rules and standards will increase our compliance costs and our exposure to the potential risk of violations of the standards. Experiencing a cybersecurity incident could cause us to be non-compliant with applicable laws and regulations, such as those promulgated by NERC and the NRC, privacy laws, or contracts that require us to securely maintain confidential data, causing us to incur costs related to legal claims or proceedings and regulatory fines or penalties.
We are subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of our security, customer information and business information. One of these agencies, NERC, has issued comprehensive regulations and standards surrounding the security of bulk power systems and is continually in the process of developing updated and additional requirements with which the utility industry must comply. The NRC also has issued regulations and standards related to the protection of critical digital assets at commercial nuclear power plants. The increasing promulgation of NERC and NRC rules and standards will increase our compliance costs and our exposure to the potential risk of violations of the standards. Experiencing a cybersecurity incident could cause us to be non-compliant with applicable laws and regulations, such as those promulgated by NERC and the NRC, privacy laws, or contracts that require us to securely maintain confidential data, causing us to incur costs related to legal claims or proceedings and regulatory fines or penalties.