48
Cyberattacks
can reach the Company’s assets and information via their interfaces with third parties or the
public internet and gain access
to critical and non-critical infrastructures. Cyberattacks can also occur via
personnel with access to critical assets or trusted
networks. Methods used to attack critical assets could
include generic or energy-sector-specific malware delivered via network
transfer, removable media,
attachments, links in e-mails or other communications, or social engineering. The methods used by
attackers are continuously evolving and can be difficult to predict and detect and may become more
sophisticated, frequent, severe, and difficult to stop to the extent that attackers are able to leverage
evolving artificial intelligence models or tools.
Despite security measures in place, the Company’s systems, assets and information could experience
security breaches that could cause system failures, disrupt energy supply and delivery, business
operations, or adversely affect safety. Such breaches could compromise customer, employee-related or
other information systems and could result in loss of service to customers, unavailability of critical assets,
safety issues, compromise billing and customer-facing information, such as outage maps, disrupt internal
control and financial processes, or result in the release, loss, corruption, destruction, and/or misuse of
critical, sensitive, confidential or proprietary information, intellectual property, or personal information of
customers or employees. These breaches could also delay delivery or result in contamination or
degradation of hydrocarbon products the Company transports, stores or
distributes.
Cyberattacks or unauthorized access may cause lost revenues,
costs, losses, regulatory penalties and
third-party damages all, or some of which may not be recoverable through insurance, legal,
regulatory
cost recovery or other processes. Resulting costs could include, amongst others, response, recovery and
remediation costs, increased protection or insurance costs and costs arising from damages and losses
incurred by third parties. This could result in a Material Adverse Effect and there is no assurance that
cyberattacks or other security breaches can be adequately addressed in a timely manner.
The Company seeks to manage these risks by aligning to a common set of cybersecurity standards and
policies derived, in part, on the National Institute of Standards and Technology’s Cyber Security
Framework, periodic security testing, program maturity objectives, cybersecurity incident readiness
program, and employee communication and training. With respect to certain of its assets, the Company is
required to comply with rules and standards relating to cybersecurity and IT including, but not limited to,
those mandated by bodies such as the North American Electric Reliability Corporation, Northeast Power
Coordinating Council, and the United States Department of Homeland Security. The status of key
elements of the Company’s cybersecurity program is reported to the RSC. The Board oversees risk and
mitigation plans in relation to cybersecurity risks and receives a quarterly update in a risk dashboard at
each regularly scheduled Board meeting.
Energy Consumption Risk
Emera’s rate-regulated utilities are affected by demand for energy based on changing customer patterns
due to fluctuations in a number of factors including general economic conditions, weather events,
customers’ focus on energy efficiency, changes in rates, and advancements in new technologies such as
rooftop solar, electric vehicles, data centers, and battery storage. Government policies promoting energy
efficiency, distributed generation, and new technology developments that enable those policies, have the
potential to impact how electricity enters the system and how it is bought and sold. In addition, increases
in distributed generation may impact demand resulting in lower load and revenues. These changes could
negatively impact Emera’s operations, rate base, net earnings, and cash flows and result in a Material
The Company is exposed to foreign currency exchange rate changes.
Emera operates internationally,
with a significant amount of the Company’s net income earned outside of Canada. As such,
Emera is
exposed to movements in exchange rates between the CAD and, particularly, the USD, which could
positively or adversely affect results.