TEC is exposed to potential risks related to cyberattacks and unauthorized access, which could cause system failures, disrupt operations or adversely affect safety.
TEC increasingly relies on information technology systems and network infrastructure to manage its business and safely operate its assets, including controls for interconnected systems of generation, distribution and transmission and financial, billing and other business systems. TEC also relies on third party service providers to conduct business. As TEC operates critical infrastructure, it may be at greater risk of cyberattacks by third parties, which could include nation-state controlled parties.
Cyberattacks can reach TEC’s networks with access to critical assets and information via their interfaces with less critical internal networks or via the public internet. Cyberattacks can also occur via personnel with direct access to critical assets or trusted networks. An outbreak of infectious disease, a pandemic or a similar public health threat, such as COVID-19, may cause disruption in normal working patterns including wide scale “work from home” policies, which could increase cybersecurity risk as the quantity of both cyberattacks and network interfaces increases. Refer to the “Public Health Risk” section below. Methods used to attack critical assets could include general purpose or energy-sector-specific malware delivered via network transfer, removable media, viruses, attachments or links in e-mails. The methods used by attackers are continuously evolving and can be difficult to predict and detect.
TEC’s systems, assets and information could experience security breaches that could cause system failures, disrupt operations or adversely affect safety. Such breaches could compromise customer, employee-related or other information systems and could result in loss of service to customers or the unavailability, release, destruction or misuse of critical, sensitive or confidential information. These breaches could also delay delivery or result in contamination or degradation of hydrocarbon products TEC transports, stores or distributes.
Should such cyberattacks or unauthorized accesses materialize, TEC could suffer costs, losses and damages all, or some of which, may not be recoverable through insurance, legal, regulatory cost recovery or other processes. If not recovered through these means, they could materially adversely affect TEC’s business and financial results including its reputation and standing with customers, regulators, governments and financial markets. Resulting costs could include, among others, response, recovery and remediation costs, increased protection or insurance costs and costs arising from damages and losses incurred by third parties. If any such security breaches occur, there is no assurance that they can be adequately addressed in a timely manner.
With respect to certain of its assets, TEC is required to comply with rules and standards relating to cybersecurity and information technology including, but not limited to, those mandated by bodies such as the North American Electric Reliability Corporation. TEC cannot be assured that its operations will not be negatively impacted by a cyberattack.
Continued effects of the ongoing COVID-19 pandemic, or an outbreak of infectious disease, another pandemic or a similar public health threat could have a negative impact on TEC’s operations.
An outbreak of infectious disease, a pandemic or a similar public health threat, such as the ongoing COVID-19 pandemic, or a fear of any of the foregoing, could adversely impact TEC, including by causing operating, supply chain and project development delays and disruptions, labor shortages and shutdowns (including as a result of government regulation and prevention measures), and delays in regulatory decisions and proceedings, which could have a negative impact on TEC’s operations.
Any adverse changes in general economic and market conditions arising as a result of a public health threat could negatively impact demand for electricity and natural gas, revenue, operating costs, timing and extent of capital expenditures, results of financing efforts, or credit risk, counterparty risk and collection risk, which could result in a material adverse effect on TEC’s business.
S-9