XML 124 R71.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management and Strategy Although many of the networks are segmented, overall network security is a centralized shared service across the Southern Company system, led by the TSO and the CISO. Recognizing that no single technology, process, or business control can effectively prevent or mitigate all risks related to cyber threats, multiple technologies, processes, and controls, all working independently but as part of a cohesive strategy, are employed to reduce risk. Southern Company system exposure and defenses are regularly tested through auditing, penetration testing, vulnerability testing, and other exercises designed to assess effectiveness. The Southern Company system emphasizes both security and resiliency through business assurance and incident response plans designed to identify, evaluate, and remediate incidents when they occur. A 24/7 security operations center is also utilized, which facilitates real-time situational awareness across the cyber-threat environment, and a robust insider threat protection program that leverages cross-function information sharing to assess insider threat activity is employed. The Southern Company system regularly reviews and updates its plans, policies, and technologies and conducts regular training exercises and crisis management preparedness activities to test their effectiveness. In addition, a security awareness program for the Southern Company system's employees has also been implemented, which is designed to educate and train employees at least annually, or more often as needed, about risks inherent to human interaction with information and operational technology. The Southern Company system's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with both the Electricity Information Sharing and Analysis Center and the Downstream Natural Gas Information Sharing and Analysis Center, the Southern Company system benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps to allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, the Southern Company system also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole. Many cybersecurity policies and standards across the Southern Company system are governed by multiple regulatory requirements. Portions of these policies and standards are audited by the FERC, the Transportation Security Administration, and the NRC, as appropriate, and are periodically evaluated by third parties such as cybersecurity insurance carriers. Certain members of senior management have high-level security clearances to facilitate access to critical information, and the Southern Company system participates in pilot programs with industry and the U.S. government to share additional information and strengthen cybersecurity and business resiliency. The Southern Company system also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, or customer or otherwise implicating the third-party technology and systems used. Among other things, the Southern Company system has established a Vendor Security Incident Working Group to address such third-party security incidents, including following up with the third party as appropriate and taking steps to mitigate any impact to systems. The Vendor Security Incident Working Group includes members of the internal cybersecurity teams to address any incidents that may invoke the CIRP. Additionally, the Southern Company system typically imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to the Southern Company system's data and systems. The Southern Company system also maintains insurance coverage for cyber incidents; the scope of coverage and fitness of coverage is evaluated each year. Incident Response The Southern Company system has adopted a CIRP that applies in the event of certain cybersecurity threats or incidents to provide a standardized guide for responding to security incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the incident response process follows the National Institute of Standards and Technology guidance and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. The CIRP is reviewed periodically to help ensure its applicability to any changing needs or circumstances and to provide users a tactical tool to effectively respond to incidents. The CIRP applies to all Southern Company system personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Southern Company system information and to all devices and network services that are owned or managed by the Southern Company system. A full tabletop exercise is performed at least annually, including stakeholders from business units beyond technology security, such as power delivery, legal, compliance, risk management, and corporate communications. In addition, the Southern Company system participates in sector-level and cross-sector exercises led by industry or the U.S. government. In the event of an incident, the technology security organization, the legal organization, and other stakeholders frequently review lessons learned after an incident has been remediated.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Although many of the networks are segmented, overall network security is a centralized shared service across the Southern Company system, led by the TSO and the CISO. Recognizing that no single technology, process, or business control can effectively prevent or mitigate all risks related to cyber threats, multiple technologies, processes, and controls, all working independently but as part of a cohesive strategy, are employed to reduce risk. Southern Company system exposure and defenses are regularly tested through auditing, penetration testing, vulnerability testing, and other exercises designed to assess effectiveness.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Board of Directors The Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process. The Board devotes significant time and attention to overseeing cybersecurity risk, and the Southern Company system's approach to cybersecurity governance establishes oversight throughout the enterprise. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Business Security and Resiliency Committee (BSRC) of the Board. Having a committee like the BSRC, focused on and dedicated to security, is a strong governance practice. Comprised solely of independent members of the Board, the BSRC is charged with oversight of risks related to cybersecurity, physical security, and operational resiliency. The BSRC includes directors with an understanding of cyber issues. The BSRC meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chair of the BSRC regularly reports to the Board in connection with key matters the BSRC considered. The BSRC routinely receives presentations on a range of topics, including the threat environment and vulnerabilities and risks, policies, practices, technology trends, and regulatory developments, from the Chief Information Security Officer (CISO) and the legal organization and, as needed, the Chief Information Officer (CIO). The CISO reports to the BSRC at each regular committee meeting. Protocols have been established by which certain cybersecurity incidents are escalated internally and, where appropriate, reported to the BSRC, and ongoing updates regarding any such incident are provided until it has been resolved. See "Incident Response" herein.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Briefings to the Board on cybersecurity matters include annual briefings to the Audit Committee and the Operations, Environmental, and Safety Committee in addition to briefings to the BSRC at each of its regular meetings (at least five times annually).
Cybersecurity Risk Role of Management [Text Block] | The TSO, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Southern Company system. The Southern Company system also relies on a Data Privacy and Protection team in the compliance organization, as well as the internal audit organization, to work with the TSO on data protection policies and practices. Multiple experienced information security leaders with internal and external security experience responsible for various parts of the business report to the CISO, each of whom is supported by a team of trained cybersecurity professionals. In addition to these internal cybersecurity capabilities, external auditors and security companies are regularly engaged to assist with assessing, testing, identifying, and managing cybersecurity, including through penetration testing, vulnerability testing, and other technical evaluations.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Board of Directors The Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process. The Board devotes significant time and attention to overseeing cybersecurity risk, and the Southern Company system's approach to cybersecurity governance establishes oversight throughout the enterprise. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Business Security and Resiliency Committee (BSRC) of the Board. Having a committee like the BSRC, focused on and dedicated to security, is a strong governance practice. Comprised solely of independent members of the Board, the BSRC is charged with oversight of risks related to cybersecurity, physical security, and operational resiliency. The BSRC includes directors with an understanding of cyber issues. The BSRC meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chair of the BSRC regularly reports to the Board in connection with key matters the BSRC considered. The BSRC routinely receives presentations on a range of topics, including the threat environment and vulnerabilities and risks, policies, practices, technology trends, and regulatory developments, from the Chief Information Security Officer (CISO) and the legal organization and, as needed, the Chief Information Officer (CIO). The CISO reports to the BSRC at each regular committee meeting. Protocols have been established by which certain cybersecurity incidents are escalated internally and, where appropriate, reported to the BSRC, and ongoing updates regarding any such incident are provided until it has been resolved. See "Incident Response" herein. Management The Southern Company system has implemented a cross-functional, risk-based, "defense-in-depth" approach to preventing, detecting, identifying, mitigating, responding to, and recovering from cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Overall network efforts are led by the CISO and the Technology Security Organization (TSO), the organization responsible for implementing, monitoring, and maintaining cybersecurity practices across the Southern Company system, and aided by the Executive Vice President of Operations and the Energy Management System and Generation organization. The CISO meets regularly with the CIO and the Chief Executive Officer and reports regularly to committees of the Board to discuss risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Security and resiliency are emphasized through business assurance, enterprise risk management, and incident response plans designed to identify, evaluate, and remediate incidents when they occur. Among other things, the Cybersecurity Incident Response Plan (CIRP) establishes a team comprised of the CISO, the Deputy CISO, the Director of the Digital Defense Center, and members of the legal and compliance organizations to evaluate emerging cyber threats and escalate to executive management and business units as appropriate. Plans, policies, and technologies are regularly updated and training exercises and crisis management preparedness activities are conducted to test effectiveness. The CISO works closely with the legal and compliance organizations, as well as the relevant business units, to help ensure broad oversight of and compliance with legal, regulatory, and contractual cybersecurity requirements. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of work experience within the Southern Company system. The CISO receives reports on cybersecurity threats from a variety of sources both internally and externally on an ongoing basis and regularly reviews risk management measures implemented to identify and mitigate cybersecurity risks. Briefings to the Board on cybersecurity matters include annual briefings to the Audit Committee and the Operations, Environmental, and Safety Committee in addition to briefings to the BSRC at each of its regular meetings (at least five times annually). Internal Cybersecurity Team The TSO, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Southern Company system. The Southern Company system also relies on a Data Privacy and Protection team in the compliance organization, as well as the internal audit organization, to work with the TSO on data protection policies and practices. Multiple experienced information security leaders with internal and external security experience responsible for various parts of the business report to the CISO, each of whom is supported by a team of trained cybersecurity professionals. In addition to these internal cybersecurity capabilities, external auditors and security companies are regularly engaged to assist with assessing, testing, identifying, and managing cybersecurity, including through penetration testing, vulnerability testing, and other technical evaluations.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of work experience within the Southern Company system.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The CISO works closely with the legal and compliance organizations, as well as the relevant business units, to help ensure broad oversight of and compliance with legal, regulatory, and contractual cybersecurity requirements. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of work experience within the Southern Company system. The CISO receives reports on cybersecurity threats from a variety of sources both internally and externally on an ongoing basis and regularly reviews risk management measures implemented to identify and mitigate cybersecurity risks. Briefings to the Board on cybersecurity matters include annual briefings to the Audit Committee and the Operations, Environmental, and Safety Committee in addition to briefings to the BSRC at each of its regular meetings (at least five times annually).
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration