XML 85 R57.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The Company’s policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company’s enterprise-wide risks, including risks associated with cyber and physical security, and the Company’s programs and practices to monitor and mitigate these risks. Management prepares comprehensive cyber security reports that are discussed at each meeting of the Finance Committee. The reports focus on the changing threat landscape and the risks to the Company, describe Eversource’s cyber security drills and exercises, attempted and actual breaches on our systems, cyber incidents within the utility industry and around the world, and mitigation strategies. In addition, third-party experts of cyber security risks provide periodic assessments to the utility industry and the Company in particular to the Finance Committee. The Company regularly reviews and updates its cyber and system security programs, and the Finance Committee continues to enhance its robust oversight activities, including meetings with financial, information technology, legal and accounting management, other members of the Board, representatives of the Company’s independent registered public accounting firm, and outside advisors and experts in cyber security risks, at which cyber and system security programs and issues that might affect the Company’s financial statements and operational systems are discussed. The Company has a robust Enterprise Risk Management Program that has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company’s Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer. Members include key leaders of the Company, including the Chief Information Officer. The Company is committed to continuous monitoring and assessment of cyber security controls. The Chief Information Security Officer is responsible for developing, implementing, and enforcing our cyber security program and information security policies to protect the Company’s information systems and operational assets. The Chief Information Security Officer position requires at least 15 years of relevant information security experience and relevant security certifications. The Chief Information Security Officer reports directly to the Chief Information Officer and provides regular updates to the executive management team. Our Chief Information Security Officer has over 20 years of relevant experience. The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit. To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer: •Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company’s cyber program has been modeled after the Department of Energy’s Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. •Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. •Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. •Established an Artificial Intelligence Executive Working Committee to ensure a “Secure by Design” approach to implementations of artificial intelligence. •The Company maintains current incident response and business continuity plans, which are periodically updated and tested. •Network activity is monitored on an ongoing basis. •Anti-phishing and malware tools are utilized and assessed. •Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry. Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company’s Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security’s list of Prohibited Nations to further protect the Company’s supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology. Our existing insurance limits may be inadequate to cover a material cyber incident. This could expose us to potentially significant claims and damages. As of December 31, 2024, there were no cyber incidents that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Company’s policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company’s enterprise-wide risks, including risks associated with cyber and physical security, and the Company’s programs and practices to monitor and mitigate these risks.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Company is committed to continuous monitoring and assessment of cyber security controls. The Chief Information Security Officer is responsible for developing, implementing, and enforcing our cyber security program and information security policies to protect the Company’s information systems and operational assets. The Chief Information Security Officer position requires at least 15 years of relevant information security experience and relevant security certifications. The Chief Information Security Officer reports directly to the Chief Information Officer and provides regular updates to the executive management team. Our Chief Information Security Officer has over 20 years of relevant experience.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit. To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer:
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer: •Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company’s cyber program has been modeled after the Department of Energy’s Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. •Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. •Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. •Established an Artificial Intelligence Executive Working Committee to ensure a “Secure by Design” approach to implementations of artificial intelligence. •The Company maintains current incident response and business continuity plans, which are periodically updated and tested. •Network activity is monitored on an ongoing basis. •Anti-phishing and malware tools are utilized and assessed. •Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry. Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company’s Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security’s list of Prohibited Nations to further protect the Company’s supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology. Our existing insurance limits may be inadequate to cover a material cyber incident. This could expose us to potentially significant claims and damages.
Cybersecurity Risk Role of Management [Text Block] | The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit. To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company’s Cyber Security Group, which is overseen by the Chief Information Security Officer: •Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company’s cyber program has been modeled after the Department of Energy’s Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. •Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. •Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. •Established an Artificial Intelligence Executive Working Committee to ensure a “Secure by Design” approach to implementations of artificial intelligence. •The Company maintains current incident response and business continuity plans, which are periodically updated and tested. •Network activity is monitored on an ongoing basis. •Anti-phishing and malware tools are utilized and assessed. •Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Specific to third parties, Eversource has implemented formal screening processes for any applicable vendors by the Company’s Cyber Security Group as part of the Procurement process. The vendors are risk ranked based on the type of work being performed. Periodic rescreening is performed on critical vendors. Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements. The Company bars sourcing from countries included on the Department of Homeland Security’s list of Prohibited Nations to further protect the Company’s supply chain. The Company maintains cyber insurance which covers breaches of networks and operational technology. Our existing insurance limits may be inadequate to cover a material cyber incident. This could expose us to potentially significant claims and damages.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration