XML 80 R47.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cybersecurity Risk Management and Strategy Process for identifying, assessing, and managing cybersecurity risks From an overall enterprise risk management perspective, the Company views cybersecurity as a “tier 1” risk and considers it one of its top priorities. The Company’s cybersecurity program (the “Cybersecurity Program”) includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program utilizes a risk-based approach and includes written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan. The Company’s Cybersecurity Program is led by its Vice President and Chief Information Officer (“CIO”), who oversees the management and development of all business technology and cyber and physical security for the Company and its subsidiaries. The CIO is also responsible for federal reliability standards compliance, critical infrastructure protection and crisis management resilience. The Cybersecurity Program is a robust, enterprise-wide, risk-based security program that adheres to the guidelines of the National Institute of Science and Technology (“NIST”) Cybersecurity Framework for Protecting Critical Infrastructure to define material risks and establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents. To protect the most critical systems, the Company also complies with the NERC Critical Infrastructure Protection Standards. The Company regularly assesses control results through third party audits, penetration tests and internal assessments to continuously improve cyber protections and data privacy controls. The Company partners with government and industry peers in several cybersecurity programs to share information and provide mutual assistance in the event of a cyber-attack. Supply chain risk of third-party suppliers is also assessed as part of the procurement process and incorporates cybersecurity contractual stipulations in its supplier contracts. The Company remains focused on increasing cybersecurity awareness and is continuously evaluating and implementing effective, up-to-date technologies and processes to enhance its cybersecurity capabilities. The Company engages in the periodic assessment and testing of the Company’s policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of the Company’s cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on the Company’s cybersecurity measures, including information security maturity assessments, audits and independent reviews of the Company’s information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Audit and Ethics Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits, and reviews. Risks from cybersecurity threats The information set forth under Item 1A, “Risk Factors” — “TXNM, PNM, and TNMP are subject to information security breaches and risks of unauthorized access to their information and operational technology systems as well as physical threats to assets.” on page A-14 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2024, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | From an overall enterprise risk management perspective, the Company views cybersecurity as a “tier 1” risk and considers it one of its top priorities. The Company’s cybersecurity program (the “Cybersecurity Program”) includes processes to identify, assess, and manage material risks from cybersecurity threats.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity risk oversight remains a priority for the Board who is responsible for oversight of the Company’s information security program, including compliance and risk management and the review of cybersecurity risks. The Board has adopted a Cyber Risk Policy which is overseen by the Audit and Ethics Committee. The Audit and Ethics Committee’s oversight of cyber risk management assists in the Board’s assessment of the adequacy of resources, funding, and focus within the Company with respect to cyber risk. Specifically, the Audit and Ethics Committee assists the Board in its oversight responsibilities regarding the company-wide security risk management practices, including overseeing the practices, procedures, and controls that management uses to identify, assess, respond to, remediate, and mitigate risks related to cybersecurity. The Audit and Ethics Committee provides oversight of management’s efforts to identify and mitigate cyber risk. Specifically, senior leadership, including the CIO, regularly briefs the Audit and Ethics Committee and the Board on Company’s cybersecurity posture. In executing its risk oversight duties, the Audit and Ethics Committee and the Board can and does access internal and external expertise regarding the Company’s challenges and opportunities related to cybersecurity.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company’s management is responsible for managing cybersecurity risk and bringing to the Audit and Ethics Committee and Board’s attention the most significant cybersecurity risks facing the Company. The CIO oversees the Company’s Cybersecurity Program and reports to the Company’s President and Chief Operating Officer.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The CIO oversees the Company’s Cybersecurity Program and reports to the Company’s President and Chief Operating Officer.
Cybersecurity Risk Role of Management [Text Block] | The Company’s management is responsible for managing cybersecurity risk and bringing to the Audit and Ethics Committee and Board’s attention the most significant cybersecurity risks facing the Company. The CIO oversees the Company’s Cybersecurity Program and reports to the Company’s President and Chief Operating Officer. The CIO leads the development, implementation, and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of the Company’s IT infrastructure. The CIO is supported by a team of enterprise information, system security, and risk professionals. The CIO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. The CIO updates senior management on these matters and works closely with the General Counsel to oversee compliance with legal, regulatory, and contractual security requirements. The CIO has significant information technology and program management experience and has served many years in the Company’s information security organization. The CIO is a Certified Project Management Professional and Change Management Registered Practitioner. In addition, the CIO has a B.B.A. in business computer systems and an MBA.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The CIO is supported by a team of enterprise information, system security, and risk professionals. The CIO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CIO has significant information technology and program management experience and has served many years in the Company’s information security organization. The CIO is a Certified Project Management Professional and Change Management Registered Practitioner. In addition, the CIO has a B.B.A. in business computer systems and an MBA.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Company’s management is responsible for managing cybersecurity risk and bringing to the Audit and Ethics Committee and Board’s attention the most significant cybersecurity risks facing the Company. The CIO oversees the Company’s Cybersecurity Program and reports to the Company’s President and Chief Operating Officer. The CIO leads the development, implementation, and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of the Company’s IT infrastructure. The CIO is supported by a team of enterprise information, system security, and risk professionals. The CIO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. The CIO updates senior management on these matters and works closely with the General Counsel to oversee compliance with legal, regulatory, and contractual security requirements.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration