Centerpoint Energy (CNP) Risk Analysis

We are subject to cyber and physical security risks related to our information technology systems, operational technology, network infrastructure, and other technology and facilities used to conduct almost all of our businesses. For example, the operation of our electric generation, transmission and distribution systems are dependent on not only physical interconnection of our facilities but also on communications among the various components of our systems and third-party systems. This reliance on information and communication between and among those components has increased since deployment of the intelligent grid, smart devices and operational technologies across our businesses. Further, certain of the various internal systems we use to conduct our businesses are highly integrated. Consequently, a cyberattack or unauthorized access in any one of these systems could potentially impact the other systems. Similarly, our business operations are interconnected with external networks and facilities. For example, the operation of an efficient deregulated wholesale and retail electric market in Texas mandates communication with ERCOT, and competitive retailers; and our Indiana Electric organization has a similar relationship with MISO. Also, the distribution of natural gas to our customers requires communications with third-party systems. Disruption of those communications, whether caused by physical disruption such as storms or other natural disasters, by failure of equipment or technology or by man-made events, such as cyberattacks or acts of terrorism, may disrupt our ability to conduct operations and control assets. The sophistication of cybersecurity threats, including those leveraging AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency, such as our use of AI, may further expose our computer systems to the risk of cybersecurity incidents. Cyberattacks, including phishing attacks and threats from the use of malware, ransomware and viruses or malicious code, and unauthorized access could also result in the loss, or unauthorized use, of confidential, proprietary or critical infrastructure data or security breaches of other information technology systems that could disrupt operations and critical business functions, adversely affect reputation, impact our customers, increase costs and subject us to possible legal claims and liability. While we have implemented and maintain a cybersecurity program designed to protect our information technology, operational technology, and data systems from such attacks, our cybersecurity program does not prevent all breaches or cyberattack incidents. We have experienced an increase in the number of attempts by external parties to access our networks or our company data without authorization. We have also experienced, and expect to continue to experience, cyber intrusions and attacks to our information systems and those of third parties, including vendors, suppliers, contractors and quasi government entities who perform certain services for us or administer and maintain our sensitive information. These prior intrusions and attacks have not had a material impact on our business, results of operations, or financial condition. Because technology is increasingly complex and cyberattacks are increasingly sophisticated and more frequent, there is a risk such incidents could have an adverse effect on us in the future. The risk of a disruption or breach of our operational technology systems, or the compromise of the data processed in connection with our operations, through a cybersecurity breach or ransomware attack, has increased as attempted attacks have advanced in sophistication and number around the world. We are not fully insured against all cybersecurity risks, any of which could adversely affect our reputation and could have an adverse effect on our financial condition, results of operations and cash flows. We depend on the secure operations of our physical assets to transport the energy we deliver and our information technology to process, transmit and store electronic information, including information and operational technology we use to safely operate our energy transportation systems. Security breaches, attacks on our infrastructure and facilities, including against the Registrants or as a means to harm a third-party by disrupting the transmission and distribution of energy, or acts of terrorism, including by foreign or domestic actors, could expose our business to a risk of loss, misuse or interruption of critical physical assets or information and functions that affect our operations, as well as potential data privacy breaches and loss of protected personal information and other sensitive information, such as Critical Energy Infrastructure Information. Such losses could result in operational impacts, damage to our assets, public or personal safety incidents, impacts to our customers, damage to the environment, reputational harm, competitive disadvantage, regulatory enforcement actions, litigation and a potential adverse effect on our operations, financial condition, results of operations and cash flows. There is no certainty that costs incurred related to actual or thwarted cyberattacks, or for the safeguarding against such security threats, will be recoverable through rates.

We are using and exploring the further use of AI, including generative AI, and its ability to enhance the services we offer to the communities we serve. There are significant risks involved in developing and deploying AI, and there can be no assurance that the use of AI will enhance our services or be beneficial to our business, including with respect to the efficiency and resiliency of our systems. For example, our AI-related efforts may give rise to risks related to harmful content, accuracy, bias, discrimination, toxicity, intellectual property infringement or misappropriation, defamation, data privacy, and cybersecurity, among others. In addition, the adoption of AI may subject us to new or enhanced governmental or regulatory scrutiny, new or amended laws, rules, directives, and regulations governing the use of AI, litigation, ethical concerns, negative consumer perceptions as to automation and AI, or other complications that could adversely affect our business, reputation, or financial results. We may not be able to recover our investments in AI technology through our regulatory proceedings, and our use of AI may subject us to legal liability. Similarly, as AI continues to evolve we may not be able to adopt and implement AI as quickly as our customers or communities desire or regulators may require, which could also adversely affect us. AI is a relatively new and rapidly evolving technology, and we are unable to predict all of the risks that may result from the adoption of our AI initiatives.

Houston Electric's, Indiana Electric's and Natural Gas' revenues and results of operations are subject to seasonality, weather conditions and other changes in electricity and natural gas usage, as applicable. Houston Electric's revenues are generally higher during the warmer months. As in certain past years, unusually mild weather in the warmer months could diminish Houston Electric's results of operations and harm its financial condition. Conversely, as in certain past years, extreme warm weather conditions could increase Houston Electric's results of operations in a manner that would not likely be annually recurring. A significant portion of Indiana Electric's sales are for space heating and cooling. Consequently, as in certain past years, Indiana Electric's results of operations may be adversely affected by warmer-than-normal heating season weather or colder-than-normal cooling season weather, while, as has occurred in certain past years, more extreme seasonal weather conditions could increase Indiana Electric's results of operations in a manner that would not likely be annually recurring. Natural Gas' revenues are customarily higher during the winter months. As in certain past years, unusually mild weather in the winter months could diminish Natural Gas' results of operations and harm its financial condition. Conversely, as occurred in certain past years, extreme cold weather conditions could increase its results of operations in a manner that would not likely be annually recurring. For information related to weather normalization regulatory mechanisms and weather hedges, see Note 9(a) to the consolidated financial statements. For additional risks related to the February 2021 Winter Storm Event, see Note 7 to the consolidated financial statements for further information.

A changing climate creates uncertainty and could result in broad changes, both physical and financial in nature, to our service territories and our business. If climate changes occur that result in warmer temperatures than normal in our service territories, financial results from our businesses could be adversely impacted. For example, where natural gas is used to heat homes and businesses, warmer weather might result in less natural gas being used, adversely affecting us. Another possible result of climate change is more frequent and more severe weather events, such as hurricanes, tornadoes, and severe winter weather conditions, including ice storms, all of which may impact our operations and ability to serve our customers. To the extent the frequency and severity of extreme weather events increases, our costs of providing service may increase, including the costs and availability of procuring insurance related to such impacts, and those costs may not be recoverable. Further, events of extreme weather could make it unsafe or hinder the effectiveness of our employees to fix, maintain and restore power to affected areas and could harm our reputation. Since certain of our facilities are located along or near the Texas gulf coast, increased or more severe hurricanes or tornadoes could increase our costs to repair damaged facilities and restore service to our customers. Our Electric and Natural Gas operations in our service territories were both also impacted by the February 2021 Winter Storm Event and could experience a similar event in the future, which could have an adverse impact on our financial condition, results of operations and cash flows. In the long term, climate change could also cause shifts in population, including customers moving away from our service territories. When we cannot deliver electricity or natural gas to customers or our customers cannot receive our services, our financial results are impacted by lost revenues, and we generally must seek approval from regulators to recover restoration costs. To the extent we are unable to recover those costs or recover in a timely manner, or if recovery of such costs results in higher rates and reduced demand for our services, our future financial results may be adversely impacted. Similarly, public and private efforts to address climate change, such as by legislation, regulation, actions by private interest groups, and litigation, could impact our ability to continue operating our businesses as we do today, significant aspects of which rely on fossil fuels. These initiatives could have a significant impact on us and our operations as well as on our third-party suppliers, vendors and partners, which could impact us by among other things, causing permitting and construction delays, project cancellations or increased project costs passed on to us. For further information on these initiatives, please see "- We are subject to operational…" Finally, we may be subject to climate change litigation, which could result in substantial fines, penalties or damages and restrictions on our operations. The oil and gas industry has already faced such litigation, challenging its marketing and use of fossil fuels and attributing climate change to emissions resulting from the use of fossil fuels, and other industries, including ours, could face such litigation in the future. For more information, see Note 7 to the consolidated financial statements, and "- CenterPoint Energy is subject to operational and financial risks..."