In the regular course of business, CMS Energy and Consumers handle a range of sensitive confidential security and customer information. In addition, CMS Energy and Consumers operate in a highly regulated industry that requires the continued operation of sophisticated information and control technology systems and network infrastructure. Despite implementation of security measures, technology systems, including disaster recovery and backup systems, are vulnerable to failure, cyber crime, unauthorized access, and being disabled. These events could impact the reliability of electric generation and electric and gas delivery and also subject CMS Energy and Consumers to financial harm. Cyber crime, which includes the use of malware, ransomware, computer viruses, and other means for disruption or unauthorized access against companies, including CMS Energy and Consumers, is increasing in frequency, scope, and potential impact. While CMS Energy and Consumers have not been subject to cyber incidents that have had a material impact on their operations to date, their security measures in place may be insufficient to prevent a major cyber incident in the future. If technology systems, including disaster recovery and backup systems, were to fail or be breached, CMS Energy and Consumers might not be able to fulfill critical business functions, and sensitive confidential and proprietary data could be compromised. In addition, because CMS Energy's and Consumers' generation, transmission, and distribution systems are part of an interconnected system, a disruption caused by a cyber incident at another utility, electric generator, system operator, or commodity supplier could also adversely affect CMS Energy or Consumers.
A variety of technological tools and systems, including both company-owned information technology and technological services provided by outside parties, support critical functions. The failure of these technologies, including backup systems, or the inability of CMS Energy and Consumers to have these technologies supported, updated, expanded, or integrated into other technologies, could hinder their business operations.