Norfolk Southern 10-K 2024-12-31

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

for the fiscal year ended December 31, 2024

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

for the transition period from ___________ to___________

Commission File Number 1-8339

NORFOLK SOUTHERN CORPORATION

(Exact name of registrant as specified in its charter)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: NONE

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer," "accelerated filer," "smaller reporting company," and "emerging growth company" in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☒ Accelerated filer ☐ Non-accelerated filer ☐ Smaller reporting company ☐ Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of the voting common equity held by non-affiliates at June 30, 2024 was $48,522,427,121 (based on the closing price as quoted on the New York Stock Exchange on June 30, 2024).

The number of shares outstanding of each of the registrant’s classes of common stock, at January 31, 2025: 226,434,128 (excluding 20,320,777 shares held by the registrant’s consolidated subsidiaries).

DOCUMENTS INCORPORATED BY REFERENCE: Portions of the Registrant’s definitive proxy statement to be filed electronically pursuant to Regulation 14A not later than 120 days after the end of the fiscal year, are incorporated herein by reference in Part III.

TABLE OF CONTENTS

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

K2

PART I

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

GENERAL – Norfolk Southern Corporation (Norfolk Southern) is an Atlanta, Georgia-based company that owns a major freight railroad, Norfolk Southern Railway Company (NSR). We were incorporated on July 23, 1980, under the laws of the Commonwealth of Virginia. Our common stock (Common Stock) is listed on the New York Stock Exchange (NYSE) under the symbol “NSC.”

Unless indicated otherwise, Norfolk Southern Corporation and its subsidiaries, including NSR, are referred to collectively as NS, we, us, and our.

We are primarily engaged in the rail transportation of raw materials, intermediate products, and finished goods primarily in the Southeast, East, and Midwest and, via interchange with rail carriers, to and from the rest of the United States (U.S.). We also transport overseas freight through several Atlantic and Gulf Coast ports. We offer the most extensive intermodal network in the eastern half of the U.S.

We make available free of charge through our website, www.norfolksouthern.com, our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after such material is electronically filed with or furnished to the U.S. Securities and Exchange Commission (SEC). In addition, the following documents are available on our website and in print to any shareholder who requests them:

• Norfolk Southern Corporation Bylaws

• Charters of the Committees of the Board of Directors

• Corporate Governance Guidelines

• Categorical Independence Standards

• The Thoroughbred Code of Ethics

• Code of Ethical Conduct for Senior Financial Officers

K3

RAILROAD OPERATIONS – At December 31, 2024, we operated approximately 19,200 route miles in 22 states and the District of Columbia.

Our system reaches many manufacturing plants, electric generating facilities, mines, distribution centers, transload facilities, and other businesses located in our service area.

Corridors with heaviest freight volume:

• New York City area to Chicago (via Allentown and Pittsburgh)

• Chicago to Macon (via Cincinnati, Chattanooga, and Atlanta)

• Central Ohio to Norfolk (via Columbus and Roanoke)

• Cleveland to Kansas City

• Birmingham to Meridian

• Memphis to Chattanooga

K4

The miles operated, which include an exclusive operating agreement for trackage rights over property owned by North Carolina Railroad Company, were as follows:

In March 2024, we completed the acquisition of a 337 mile railway line that extends from Cincinnati, Ohio to Chattanooga, Tennessee from the Cincinnati Southern Railway (CSR), which we previously operated under a lease. See further discussion in Item 7 “Management's Discussion and Analysis of Financial Condition and Results of Operations” and Item 8 “Notes to Consolidated Financial Statements.”

We operate freight service over lines with significant ongoing Amtrak and commuter passenger operations and conduct freight operations over trackage owned or leased by Amtrak, New Jersey Transit, Southeastern Pennsylvania Transportation Authority, Metro-North Commuter Railroad Company, Virginia Passenger Rail Authority (VPRA), and Michigan Department of Transportation.

The following table sets forth certain statistics relating to our operations for the past five years:

RAILWAY OPERATING REVENUES – Total railway operating revenues were $12.1 billion in 2024. Following is an overview of our three commodity groups. See the discussion of merchandise revenues by major commodity group, intermodal revenues, and coal revenues and tonnage in Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

MERCHANDISE – Our merchandise commodity group is composed of four groupings:

• Agriculture, forest and consumer products includes soybeans, wheat, corn, fertilizer, livestock and poultry feed, food products, food oils, flour, sweeteners, ethanol, lumber and wood products, pulp board and paper products, wood fibers, wood pulp, beverages, and canned goods.

• Chemicals includes sulfur and related chemicals, petroleum products (including crude oil), chlorine and bleaching compounds, plastics, rubber, industrial chemicals, chemical wastes, sand, and natural gas liquids.

• Metals and construction includes steel, aluminum products, machinery, scrap metals, cement, aggregates, minerals, clay, transportation equipment, and items for the U.S. military.

• Automotive includes finished motor vehicles and automotive parts.

K5

In 2024, we handled 2.3 million merchandise carloads, which accounted for 62% of our total railway operating revenues.

INTERMODAL – Our intermodal commodity group consists of shipments moving in domestic and international containers and trailers. These shipments are handled on behalf of intermodal marketing companies, international steamship lines, premium customers, and asset-owning companies. In 2024, we handled 4.1 million intermodal units, which accounted for 25% of our total railway operating revenues.

COAL – Coal revenues accounted for 13% of our total railway operating revenues in 2024. We handled 76.7 million tons, or 0.7 million carloads, most of which originated on our lines from major eastern coal basins with the balance from major western coal basins received via the Memphis and Chicago gateways. Our coal franchise supports the electric generation market, directly serving 18 coal-fired power plants, as well as the export, domestic metallurgical, and industrial markets, primarily through direct rail and river, lake, and coastal facilities, including various terminals on the Ohio River, at Lamberts Point in Norfolk, Virginia, at the Port of Baltimore, and on Lake Erie.

FREIGHT RATES – Our predominant pricing mechanisms, private contracts and exempt price quotes, are not subject to regulation. In general, market forces are the primary determinant of rail service prices.

RAILWAY PROPERTY

Our railroad infrastructure makes us capital intensive with net properties of approximately $36 billion on a historical cost basis.

Property Additions – Property additions for the past five years were as follows:

Our capital spending and replacement programs are and have been designed to support our ability to provide safe, efficient, and reliable rail transportation services.

K6

Equipment – Our equipment includes owned and leased locomotives and railcars; maintenance of way equipment and machinery; other equipment and tools used in our shops, offices, and facilities; and vehicles and other equipment used for maintenance, transportation, and other activities. Our equipment includes both owned equipment acquired by us and equipment held under lease arrangements. At December 31, 2024, we owned or leased the following revenue generating equipment:

The following table indicates the number and year built for locomotives and freight cars owned at December 31, 2024:

K7

The following table shows the average age of our owned locomotive and freight car fleets at December 31, 2024 and information regarding 2024 retirements:

Track Maintenance – Of the 35,000 total miles of track on which we operate, we are responsible for maintaining 28,300 miles, with the remainder being operated under trackage rights from other parties responsible for maintenance.

Over 85% of the main line trackage (including first, second, third, and branch main tracks, all excluding rail operated pursuant to trackage rights) has rail ranging from 131 to 155 pounds per yard with the standard installation currently at 136 pounds per yard. Approximately 40% of our lines, excluding rail operated pursuant to trackage rights, carried 20 million or more gross tons per track mile during 2024.

The following table summarizes several measurements regarding our track roadway additions and replacements during the past five years:

Traffic Control – Of the 16,200 route miles we dispatch, 11,300 miles are equipped with signalization. This includes 8,500 miles governed by Centralized Traffic Control (CTC) and 2,800 miles utilizing Automatic Block Signals. Within the 8,500 CTC miles, 7,600 miles are controlled wirelessly through our data radio network and other infrastructure.

ENVIRONMENTAL MATTERS – Compliance with laws and regulations relating to the protection of the environment is one of our principal goals. With the exception of our response to the Eastern Ohio Incident (the “Incident” as defined in Note 18) such compliance has not had a material effect on our financial position, results of operations, or liquidity. For further information on the Incident and environmental matters, see Note 18 in Item 8 “Notes to Consolidated Financial Statements.”

HUMAN CAPITAL MANAGEMENT

Workforce – We employed an average of 20,200 employees during 2024 and 19,600 employees at the end of 2024. Approximately 80% of our railroad employees are covered by collective bargaining agreements with various labor unions and referred to as “craft” employees. See the discussion of “Labor Agreements” in Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The remainder of our workforce is composed of management employees.

Safety – Safety is a core value at Norfolk Southern. We are dedicated to providing employees with a safe workplace and the knowledge and tools they need to work safely and return home safely every day. Our commitment to an injury-free workplace is outlined in our Risk Reduction Program, which focuses on safety policies and procedures, risk-based hazard management program, safety outreach and communications, technology analysis and implementation, and collaboration with craft employees. Our safety programs, practices, and messaging further reinforce the importance of working safely including the imperative to speak up with ideas and concerns as well as reinforce the universal authority to stop work if ever unsure or detect a risk that is not adequately safeguarded. We measure employee safety performance through internal metrics such as accidents, injuries, and serious injuries per 200,000 employee-hours. We also use metrics established by the Federal Railroad

K8

Administration (FRA) to measure FRA-reportable accidents per million train miles and injuries per 200,000 employee-hours. Given that safety continues to be a top priority, and the importance of safety among our workforce and to our business, our Board of Directors (Board) has a standing Safety Committee that, among other duties, reviews, monitors, and evaluates our compliance with our safety programs and practices.

Craft Workforce Levels and Productivity – Maintaining appropriate headcount levels for our craft-employee workforce is critical to our on-time and consistent delivery of customers’ goods and operational efficiency goals. We manage this human capital metric through forecasting tools designed to ensure the optimal level of staffing to meet business demands. We measure and monitor employee productivity based on various factors, including gross ton miles per train and engine employee.

Attracting and Retaining Management Employees – Our talent strategy for management employees is essential to attracting strong candidates in a competitive talent environment. We evaluate the effectiveness of that strategy by studying market trends, benchmarking the attractiveness of our employee value proposition, maintaining a competitive compensation package, and analyzing retention data.

We also focus on driving employee engagement, which is key to increasing employee productivity, retention, and safety. We take a data-centric approach, including the use of periodic surveys among employees, to identify new initiatives that will help boost engagement and drive business results.

Employee Development and Training – We provide a range of developmental programs, opportunities, skills, and resources for our employees to be successful in their careers. We provide classroom instruction, hands-on training and simulation-based training designed to improve on-the-job effectiveness and safety outcomes.

We also use modern learning and performance technologies to offer robust professional growth opportunities. Through on-demand digital course offerings, custom-built learning paths, and in-person facilitated content, our programs provide a holistic and inclusive approach to professional development throughout an employee's career.

Workplace Experience – As a leading transportation service company, we recognize that success in the global marketplace relies on the recruitment and retention of top-tier talent, as well as leveraging the expertise and experiences of individuals from all backgrounds.

In pursuit of this goal, we are dedicated to establishing a workplace where a broad spectrum of identities, perspectives, and experiences is not only represented but also valued and empowered to thrive.

GOVERNMENT REGULATION – In addition to environmental, safety, securities, and other regulations generally applicable to all business, our railroads are subject to regulation by the U.S. Surface Transportation Board (STB). The STB has jurisdiction to varying extents over rates, routes, customer access provisions, fuel surcharges, conditions of service, and the extension or abandonment of rail lines. The STB has jurisdiction to determine whether we are “revenue adequate” on an annual basis based on the results of the prior year. A railroad is “revenue adequate” on an annual basis under the applicable law when its return on net investment exceeds the rail industry’s composite cost of capital. This determination is made pursuant to a statutory requirement. The STB also has jurisdiction over the consolidation, merger, or acquisition of control of and by rail common carriers.

The relaxation of economic regulation of railroads, following the Staggers Rail Act of 1980, included exemption from STB regulation of the rates and most service terms for intermodal business (trailer-on-flat-car, container-on-flat-car), rail boxcar shipments, lumber, manufactured steel, automobiles, and certain bulk commodities such as sand, gravel, pulpwood, and wood chips for paper manufacturing. Further, all shipments that we have under contract are effectively removed from commercial regulation for the duration of the contract. Approximately 90% of our revenues comes from either exempt shipments or shipments moving under transportation contracts; the remainder comes from shipments moving under public tariff rates.

K9

Efforts have been made over the past several years to increase federal economic regulation of the rail industry, and such efforts may continue in 2025. The Staggers Rail Act of 1980 substantially balanced the interests of shippers and rail carriers, and encouraged and enabled rail carriers to innovate, invest in their infrastructure, and compete for business, thereby contributing to the economic health of the nation and to the revitalization of the industry. Accordingly, we will continue to oppose efforts to reimpose increased economic regulation.

Railroads are also subject to the enactment of laws by Congress and regulation by the U.S. Department of Transportation (DOT) (including the FRA) and the U.S. Department of Homeland Security (DHS) (including the Transportation Security Administration (TSA)), which regulate most aspects of our operations related to safety, security, and cybersecurity.

Government regulations are further discussed within Item 1A “Risk Factors,” and the safety and security of our railroads are discussed within the “Security of Operations” section contained herein.

COMPETITION – There is continuing strong competition among rail, water, and highway carriers. Price is usually only one factor of importance as shippers and receivers choose a transport mode and specific hauling company. Inventory carrying costs, service reliability, ease of handling, and the desire to avoid loss and damage during transit are also important considerations, especially for higher-valued finished goods, machinery, and consumer products. Even for raw materials, semi-finished goods, and work-in-progress, users are increasingly sensitive to transport arrangements that minimize problems at successive production stages.

Our primary rail competitor is CSX Corporation (CSX); both we and CSX operate throughout much of the same territory. Other railroads also operate in parts of the territory. We also compete with motor carriers, water carriers, and with shippers who have the additional options of handling their own goods in private carriage, sourcing products from different geographic areas, and using substitute products.

Certain marketing strategies to expand reach and shipping options among railroads and between railroads and motor carriers enable railroads to compete more effectively in specific markets.

SECURITY OF OPERATIONS – We continue to enhance the security of our rail system. Our comprehensive security plan is modeled on and was developed in conjunction with the security plan prepared by the Association of American Railroads (AAR) post September 11, 2001. The AAR Security Plan defines four Alert Levels and details the actions and countermeasures that are being applied across the railroad industry as the risk of terrorist, extremist, or seriously disruptive cyber-attack increases or decreases. The Alert Level actions include countermeasures that will be applied in three general areas: (1) operations (including transportation, engineering, and mechanical); (2) information technology and communications; and, (3) railroad police. All of our Operations Division employees are advised by their supervisors or train dispatchers, as appropriate, of any change in Alert Level and any additional responsibilities they may incur due to such change.

Our security plan also complies with DOT security regulations pertaining to training and security plans with respect to the transportation of hazardous materials. As part of the plan, security awareness training is given to all railroad employees who directly affect hazardous material transportation safety and is integrated into hazardous material training programs. Additionally, location-specific security plans are in place for rail corridors in certain metropolitan areas referred to as High Threat Urban Areas (HTUA). Particular attention is aimed at reducing risk in a HTUA by: (1) the establishment of secure storage areas for rail cars carrying toxic-by-inhalation (TIH) materials; (2) the expedited movement of trains transporting rail cars carrying TIH materials; (3) reducing the number of unattended loaded tank cars carrying TIH materials; and (4) cooperation with federal, state, local, and tribal governments to identify those locations where security risks are the highest.

We also operate four facilities that are under U.S. Coast Guard (USCG) Maritime Security Regulations. With respect to these facilities, each facility’s security plan has been approved by the applicable Captain of the Port and remains subject to inspection by the USCG.

K10

Additionally, we continue to engage in close and regular coordination with numerous federal and state agencies, including the DHS, the TSA, the Federal Bureau of Investigation, the FRA, the USCG, U.S. Customs and Border Protection, the Department of Defense, and various state Homeland Security offices.

In 2024, through the Norfolk Southern Operation Awareness and Response Program as well as participation in the Transportation Community Awareness and Emergency Response Program, we provided rail accident response training to more than 5,500 emergency responders, such as local police and fire personnel, utilizing a combination of online training and face-to-face training sessions as well as the Norfolk Southern Safety Train. We also have ongoing programs to sponsor local emergency responders at the Security and Emergency Response Training Center.

We also continually evaluate ourselves for appropriate business continuity and disaster recovery planning, with test scenarios that include cybersecurity attacks. Our risk-based information security program helps ensure our defenses and resources are aligned to address the most likely and most damaging potential attacks, to provide support for our organizational mission and operational objectives, and to keep us in the best position to detect, mitigate, and recover from a wide variety of potential attacks in a timely fashion.

The risks set forth in the following risk factors could have a material adverse effect on our financial position, results of operations, or liquidity in a particular year or quarter, and could cause those results to differ materially from those expressed or implied in our forward-looking statements. The information set forth in this Item 1A “Risk Factors” should be read in conjunction with the rest of the information included in this annual report, including

Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and Item 8 “Financial Statements and Supplementary Data.” We have experienced a number of the risks described below in connection with the Incident and the Incident Proceedings (defined below). The risks described below should be read in conjunction with the information regarding the Incident and Incident Proceedings provided in Note 18 in Item 8 “Notes to Consolidated Financial Statements.”

INCIDENT RISKS

As defined and as further described in Note 18 in Item 8 “Notes to Consolidated Financial Statements,” there was an Incident that occurred in the first quarter of 2023 that consisted of a February 3, 2023 train derailment in East Palestine, Ohio that included 11 non-Company-owned tank cars containing hazardous materials, fires associated with the derailment that threatened certain of the tank cars, and a controlled vent and burn procedure conducted on February 6, 2023 on five of the derailed tank cars, all of which contained vinyl chloride. As a result of the Incident, we became subject to numerous legal, regulatory, legislative, and other proceedings related thereto, including but not limited to, the National Transportation Safety Board (NTSB) Investigation, the FRA Incident Investigation, the FRA Safety Assessment, the U.S. Department of Justice (DOJ) Complaint, the Ohio Complaint, the Incident Lawsuits, the Shareholder Matters, and the Incident Inquiries and Investigations (each as defined in Note 18 in Item 8 “Notes to Consolidated Financial Statements”) in addition to other proceedings, actions, or potential changes in response to the Incident, including but not limited to those related to, among other items, train size, train length, train composition, crew size, or detection systems (collectively, the “Incident Proceedings”). Set forth below are additional risks pertaining to an investment in the Company that are related to the Incident and the Incident Proceedings.

The costs, liabilities, fines, penalties, and/or financial impact resulting from or related to the Incident or the Incident Proceedings have been significant to date, may exceed expected or accrued amounts, and have and can be expected to continue to negatively affect our financial results. We have incurred and will continue to remain subject to incurring significant costs, liabilities, fines, and penalties related to the Incident and the Incident Proceedings, including amounts that may have a material adverse effect on our financial position, results of operations, or liquidity.

K11

While we have accrued estimates of probable and reasonably estimable liabilities with respect to the Incident and the Incident Proceedings, we cannot predict the final outcome or estimate the reasonably possible range of loss with certainty, and such estimates may change over time due to a variety of factors, including but not limited to those set forth in Note 18 in Item 8 “Notes to Consolidated Financial Statements” or other unfavorable or unexpected developments or outcomes which could result in our current estimates being insufficient. These estimated amounts also do not include any estimate of loss for specific items for which we believe a loss is either not probable or not reasonably estimable for the reasons set forth in Note 18 in Item 8 “Notes to Consolidated Financial Statements.” As a result, our currently accrued amounts of estimated liabilities may be insufficient, and any additional, new or updated accruals could have a material adverse effect on our results of operations or financial position.

New or additional governmental regulation and/or operational changes resulting from or related to the Incident or the Incident Proceedings may negatively impact us, our customers, the rail industry, or the markets we serve. The legislative, regulatory, operational, or other actions taken, protocols adopted (including by us), or changes resulting from the Incident or any of the Incident Proceedings may, either individually or in the aggregate, have a material adverse effect on us, our customers, the rail industry, or the markets we serve. We also face risks from requirements that may be imposed by the government in resolution of government actions, including, for example, restrictions on our methods of operations. Our inability to comply with the requirements of any new or additional laws, regulations, or operating protocols resulting from or related to the Incident or the Incident Proceedings may have a material adverse effect on our financial position, results of operations, liquidity, or operations.

REGULATORY AND LEGISLATIVE RISKS

Governmental legislation, regulation, and Executive Orders over commercial, operational, tax, safety, security, or cybersecurity matters could negatively affect us, our customers, the rail industry, or the markets we serve. Congress can enact laws, agencies can promulgate regulations, and Executive Orders can be issued that increase or alter regulation in a way that negatively affects us, our customers, the rail industry, or the markets we serve. Railroads presently are subject to commercial and operational regulation by the STB, which has jurisdiction to varying extents over rates, routes, customer access provisions, fuel surcharges, conditions of service, and the extension or abandonment of rail lines.

The STB also has jurisdiction over the consolidation, merger, or acquisition of control of and by rail common carriers. Additional or updated regulation of the rail industry by Congress or the STB, whether under new, existing or amended laws or regulations, could have a significant negative impact on our ability to negotiate prices for rail services, on our railway operating revenues, and on the efficiency, conduct, or complexity of our operations. Such additional or updated industry regulation, as well as enactment of any new or updated tax laws, could also negatively impact cash flows from our operating activities and, therefore, result in reduced capital spending on our rail network or abandonment of lines.

Railroads are also subject to the enactment of laws by Congress and regulation by the DOT (including the FRA) and the DHS (including the TSA), which regulate many aspects of our operations related to safety, security, and cybersecurity. Additional or updated safety, security, or cybersecurity regulation by Congress, the DOT, or DHS could have a negative impact on our business and the efficiency, conduct, or complexity of our operations including (but not limited to) increased operating costs, capital expenditures, claims, and litigation.

Our inability to comply with, or operational practices and costs necessary to adhere to, the requirements of existing or updated laws, regulations, or Executive Orders that govern our operations or the rail industry, including but not limited to those pertaining to commercial, operational, tax, safety, security, or cybersecurity matters, as such requirements may be interpreted or enforced from time to time (such as in connection with a pending regulatory or other legal proceedings or lawsuits), could have a material adverse effect on our financial position, results of operations, or liquidity.

We are addressing multiple governmental actions as a result of the Incident, as noted in “Incident Risks” above.

K12

Federal and state environmental laws and regulations could negatively impact us and our operations. Our operations are subject to extensive federal, state and local environmental laws and regulations concerning, among other things: emissions to the air; discharges to waterways or groundwater supplies; handling, storage, transportation, use, and disposal of waste and other materials; and, the cleanup of hazardous material or petroleum releases. The risk of incurring environmental liability, for acts and omissions, past, present, and future, is inherent in the railroad business. This risk includes property owned by us, whether currently or in the past, that is or has been subject to a variety of uses, including our railroad operations and other industrial activity by past owners or our past and present tenants.

Environmental problems that are latent or undisclosed may exist on these properties, and we could incur environmental liabilities or costs, the amount and materiality of which cannot be estimated reliably at this time, with respect to one or more of these properties. Moreover, lawsuits and claims involving other unidentified environmental sites and matters are likely to arise from time to time.

Our inability to comply with the extensive federal, state and local environmental laws and regulations to which we are subject could result in significant liabilities, fines, or sanctions, including those related to the investigation or remediation of known and unknown environmental contamination, or otherwise adversely impact our operations.

As noted in “Incident Risks” above, in connection with the Incident, we are experiencing negative impacts related to environmental matters, including extensive cleanup costs and litigation related to alleged environmental impacts of the Incident.

U.S. international trade relationships may adversely impact our customers, our industry, and our business. We transport a significant number of shipments that have either been imported into the U.S. or are destined for export from the U.S. Trade discussions and arrangements between the U.S. and various of its trading partners are fluid, and existing and future trade agreements are, and are expected to continue to be, subject to a number of uncertainties, including the imposition of new tariffs or adjustments and changes to the products covered by existing tariffs. Any decision by the U.S. government to adopt actions such as border taxes on imports, an increase in customs duties or tariffs, or the renegotiation of U.S. trade agreements, or any other action that could have a negative impact on international trade, including corresponding actions taken by other countries in response to U.S. governmental actions, could cause a reduction in the volume of shipments by many of our customers. Any changes in tax and trade policies in the U.S. and corresponding actions by other countries could adversely impact our financial performance.

In addition, compliance with any new laws, regulations, or policies with regard to any of the foregoing may increase our operating costs or require significant capital expenditures. Any failure to comply with applicable laws, regulations or policies in the U.S. or other countries could result in substantial fines or possible revocation of our authority to conduct our operations, which could materially adversely affect us.

K13

OPERATIONAL RISKS

A significant adverse event on our network may significantly impede our ability to operate and serve our customers. The nature of our operations inherently comes with the risk that one or more significant adverse events or outages may occur on or impact our network resulting in our inability or restricted ability to provide rail transportation services to our customers. These events include but are not limited to, a mainline accident, a hazardous material discharge, a climate-related network outage, or a technology-related network outage. Any one or more of these incidents could expose us to significant operational and managerial challenges, as well as reputational damage, requiring a significant amount of time and focus of our Board and management team, as well as significant lost revenues, expenses, liabilities, fines, and penalties, including amounts that may have a material adverse effect on our financial position, results of operations, or liquidity. One or more of these events may also result in subsequent legislative, regulatory, operational or other responsive actions taken, changes or protocols adopted (including by us), or requirements imposed that may, either individually or in the aggregate, have a material adverse effect on our financial position, results of operations, liquidity, or operations, or on our customers, the rail industry, or the markets we serve.

If we are unable to successfully execute on our strategic initiatives, our business and future results of operations may suffer. Our growth strategy includes increasing the volume of shipments moving through our railway networks. We are reliant on the success of our strategic plans and initiatives to execute on this growth strategy, as well as to help offset increasing costs. These strategic plans include marketing, service, growth, and productivity initiatives. The timely and effective execution of our strategies are dependent upon, among other factors, (i) our ability to maintain satisfactory relations with our customers, employees, and other key stakeholders, (ii) our ability to effectively control costs, (iii) the progress and success of our safety programs and inspection technologies, and (iv) our ability to timely and effectively maintain and upgrade technology systems and other infrastructure for our railway networks. Our failure to successfully execute on our strategic initiatives may expose us to a number of risks, including, that our projected volume growth may differ from actual results, and prior capital investments based on our projections may contribute to excess capacity that could negatively impact our profitability.

As a common carrier by rail, we must offer to transport hazardous materials, which exposes us to significant costs and claims. Transportation of certain hazardous materials or third party-owned equipment (typically used to transport such materials) creates risks of significant losses in terms of personal injury and property (including environmental) damage and compromises critical parts of our rail network. The costs of a catastrophic rail accident involving hazardous materials or third party-owned equipment could exceed our insurance coverage. We have obtained insurance for potential losses for third-party liability and first-party property damages (see Note 18 in Item 8 “Notes to Consolidated Financial Statements”); however, insurance is available from a limited number of insurers and may not continue to be available or, if available, may not be obtainable on terms acceptable to us. Any future legislation preventing the transportation of hazardous materials through specific cities could have negative impacts including increased network congestion and operating costs, reduced operating efficiency, and increased risk of an accident involving hazardous materials.

With regard to the risks arising from the transportation of hazardous materials, the Incident and the Incident Proceedings have given rise to significant costs to us and impacts on our rail network, as noted in “Incident Risks” above. With respect to third party-owned equipment, the primary risk arises from the potential for a latent defect we are unable to identify despite robust safety inspection protocols.

We face competition from other transportation providers. We are subject to competition from motor carriers, railroads and, to a lesser extent, ships, barges, and pipelines, on the basis of transit time, pricing, and quality and reliability of service. While we have primarily used internal resources to build or acquire and maintain our rail system, trucks and barges have been able to use public rights-of-way maintained by public entities. Any future improvements, expenditures, legislation, or regulation changing or materially increasing the efficiency or reducing the cost of one or more alternative modes of transportation in the regions in which we operate (such as granting materially greater latitude for motor carriers with respect to size or weight limitations or adoption and utilization of

K14

autonomous commercial vehicles) could have a material adverse effect on our ability to compete with other modes of transportation. In addition, our industry continues to evolve, including customer demands for faster transit times and increased visibility, and the potential for increased competition (due to growth in the market, competitors with improved financial capacity or technology, or business combinations resulting in one or more competitors providing a wider variety of services and products at competitive prices) which may, either individually or in the aggregate, have a material adverse effect on our business or results of operations.

Capacity constraints could negatively impact our service and operating efficiency. We have experienced and may again experience capacity constraints on our rail network related to employee or equipment shortages, increased demand for rail services, severe weather, congestion on other railroads, including passenger activities, or impacts from changes to our network structure or composition. Such constraints could result in operational inefficiencies or adversely affect our operations.

Significant increases in demand for rail services could result in the unavailability of qualified personnel and resources like locomotives. Changes in workforce demographics, training requirements, and availability of qualified personnel, particularly for engineers and conductors, have negatively impacted and may again negatively impact our ability to meet short-term demand for rail service. Unpredicted increases in demand for rail services may exacerbate such risks and could negatively impact our operational efficiency.

Constraints on the supply chain or the operations of carriers with which we interchange may adversely affect our operations. Our ability to provide rail service to our customers depends in large part upon a functioning global supply chain and our ability to maintain collaborative relationships with connecting carriers (including shortlines and regional railroads) with respect to, among other matters, freight rates, revenue division, car supply and locomotive availability, data exchange and communications, reciprocal switching, interchange, and trackage rights. Deterioration in the supply chain or service provided by connecting carriers, or in our relationship with those connecting carriers, could result in our inability to meet our customers’ demands or require us to use alternate train routes, which could result in significant additional costs and network inefficiencies. Additionally, any significant consolidations, mergers, or operational changes among other railroads may alter our market access and reach.

We may be negatively affected by terrorism or war. Any terrorist attack, or other similar event, any government response thereto, and war or risk of war could cause significant business interruption or other operational challenges. Because we play a critical role in the nation’s transportation system, we could become the target of such an attack or have a significant role in the government’s preemptive approach or response to an attack or war.

Although we currently maintain insurance coverage for third-party liability arising out of war and acts of terrorism, we maintain only limited insurance coverage for first-party property damage and damage to property in our care, custody, or control caused by certain acts of terrorism. In addition, premiums for some or all of our current insurance programs covering these losses could increase dramatically, or insurance coverage for certain losses could be unavailable to us in the future.

We may be negatively affected by supply constraints resulting from disruptions in our fuel markets or supplier markets. We consumed approximately 373 million gallons of diesel fuel in 2024. Fuel availability could be affected by limitation in the fuel supply or by imposition of mandatory allocation or rationing regulations. A severe fuel supply shortage arising from production curtailments, increased demand in existing or emerging foreign markets, disruption of oil imports, disruption of domestic refinery production, damage to refinery or pipeline infrastructure, political unrest, war, or other factors could impact us as well as our customers and other transportation companies.

Due to the capital-intensive nature, as well as the industry-specific requirements of the rail industry, high barriers of entry exist for potential new suppliers of core railroad items, such as locomotives and rolling stock equipment. As a result, we are dependent on certain key suppliers and manufacturers of locomotive and railroad items. Disruption to one or more of our key suppliers or manufacturers, including as a result of stopped or restricted production, labor stoppage or restriction, or significant supply shortage or outage could negatively impact our operating efficiency

K15

and increase costs. Additionally, we compete with other industries for available capacity and raw materials used in the production of locomotives and certain track and rolling stock materials. Changes in the competitive landscapes of these limited supplier markets could also result in significantly increased prices or material shortages.

We may be negatively affected by energy prices. Fuel and energy costs have a significant impact on our operations. Volatility in energy prices could have a significant effect on a variety of items including, but not limited to: the economy; demand for transportation services; business related to the energy sector, including crude oil, natural gas, and coal; fuel prices; and, fuel surcharges, each of which could have a material impact on our business and results of operations. In addition, we may also experience a disruption in energy supplies as a result of new or increased regulation, as a result of war or geopolitical conflicts, weather-related events or natural disasters, or other factors beyond our control, which could have a material adverse effect on our business.

Pandemics, epidemics, or endemic diseases could further negatively impact us, our customers, our supply chain, and our operations. The magnitude and duration of a pandemic, epidemic, or endemic disease, and its impact on our customers and general economic conditions can influence the demand for our services and affect our revenues. In addition, such outbreaks could affect our operations and business continuity if a significant number of our essential employees, overall or in a key location, are unable to work from contraction of or exposure to the disease or if governmental orders prevent our employees or critical suppliers from working. To the extent such diseases adversely affect our business and financial results, they may also have the effect of heightening many of the other risks described in the risk factors included herein or may affect our operating and financial results in a manner that is not presently known to us.

Our business is capital intensive, and we must make capital decisions based upon expectations of future usage of our assets. We make significant investments in our railroad infrastructure, including railroad property, track infrastructure, locomotives, freight cars, intermodal equipment, technology, and other assets to support our network, much of which is costly and requires significant capital outlay. The amount and timing of capital investments depend on various factors, including expectations of future carload traffic. In many cases, we must make advance commitments to purchase or modify equipment prior to such equipment being needed. As a result, we must predict volume levels and other requirements and make commitments based on those projections. A significant variance in our expectations or projections could result in too much or too little equipment relative to our actual needs and volumes, thereby negatively impacting our operations or financial results.

TECHNOLOGY RISKS

A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations. To conduct business, we extensively rely on information and operational technology systems. The threat landscape is vast, with potential attacks from cybercriminals, nation-states, state-sponsored actors and others including, but not limited to, service denials, unauthorized access, compromised equipment or rolling stock, extortion, or theft of data or money. As a result, our business continuity and disaster recovery plans and activities may not be sufficient for all eventualities, resulting in the potential for a data breach or significant service or operational disruption or failure involving one or more information or operational technology systems operated by us or under control of third parties, including computer hardware, software, cloud services and transportation and communications equipment. Such failures or disruptions can adversely impact our business by, among other things, preventing intercompany communications and disrupting operations that may result in direct or indirect monetary losses, damage to equipment or property, or loss of confidence in corporate competency. Any one or more of these events could have a material adverse effect on our results of operations, financial position, or operations. Although we maintain security programs designed to protect our information and operational technology systems, we are continually targeted by threat actors attempting to access our networks and we may be unable to detect or prevent a breach of our systems or disruption to our service in the future. In addition, while we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. These potentially impactful future events could include service disruptions, unauthorized access to our systems, viruses, ransomware, and/or the compromise, acquisition, or destruction of our

K16

data. We also could be impacted by cybersecurity events targeting third parties that we rely on for business operations, including third party vendors that have access to our systems or data and third parties who provide services and are in our supply chain. Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation or government action or increased regulation, which could result in penalties, fines or judgments. In addition, our failure to comply with or adhere to privacy-related or data protection laws and regulations could result in government investigations and proceedings against us, or litigation, resulting in adverse reputational impacts, penalties, and legal liability.

Our business may be seriously harmed if we fail to develop, implement, maintain, upgrade, enhance, protect and integrate our information or operational technology systems. If we fail to develop, acquire or implement new technology, or otherwise fail to maintain, protect or integrate our information or operational technology systems, we may suffer a competitive disadvantage within the rail industry and with companies providing alternative modes of transportation service. The techniques used by cybersecurity threat actors to obtain unauthorized access, disable or degrade service or sabotage systems change frequently, as data breaches and other cybersecurity events have become increasingly commonplace. Consequently, these techniques may be difficult to detect and cybersecurity events are therefore increasingly difficult to prevent. The rapid evolution and increased adoption of emerging technologies, such as artificial intelligence and machine learning, may make it more difficult to anticipate cybersecurity threats and implement adequate protective countermeasures. If we fail to adequately develop or maintain our information or operational technology systems or cybersecurity infrastructure, we may become increasingly vulnerable to cybersecurity events, or other breaches or disruptions to our information or operational technology systems.

LITIGATION RISKS

We may be subject to various claims and lawsuits that could result in significant expenditures. The nature of our business exposes us to the potential for various claims and litigation related to labor and employment, personal injury, commercial disputes, freight loss and other property damage, and other matters. Job-related personal injury and occupational claims are subject to the Federal Employer’s Liability Act (FELA), which is applicable only to railroads. FELA’s fault-based tort system produces results that are unpredictable and inconsistent as compared with a no-fault worker’s compensation system. The variability inherent in this system could result in actual costs being different from the liability recorded.

A catastrophic rail accident, whether on our lines or another carrier’s, involving any or all of release of hazardous materials, freight loss, property damage, personal injury, and environmental liability could compromise critical parts of our rail network. Losses associated with such an accident involving us could exceed our insurance coverage, resulting in a material adverse effect on our financial position or liquidity. Any material changes to current litigation trends could also have a material adverse effect on our financial position or liquidity to the extent not covered by insurance.

We have obtained insurance for potential losses for third-party liability and first-party property damages; however, insurance is available from a limited number of insurers and may not continue to be available or, if available, may not be obtainable on terms acceptable to us.

We are incurring significant expenditures as a result of claims and lawsuits arising from the Incident and the related Incident Proceedings, as described in “Incident Risks” above.

HUMAN CAPITAL RISKS

Failure to attract, retain, and transition key executive officers, or skilled professional or technical employees could adversely impact our business and operations. Our success depends on our ability to attract and retain skilled employees, including key executive officers to oversee our operational, productivity, marketing, and technological initiatives, as well as a sufficient number of skilled professional and craft employees to enable us to

K17

efficiently conduct our operations. Difficulties in recruiting and retaining skilled employees, including train and engine workers, key executives, and other skilled professional and technical employees; the loss of such individuals; and/or our inability to successfully transition key executive, professional, technical, or skilled roles could each have a material adverse effect on our financial position, results of operations, and operations. The loss of one or more key employees could also result in the depletion of our institutional knowledge base and may result in our inability or increased difficulty in successfully transitioning key roles, which could materially adversely impact our business.

The vast majority of our employees belong to labor unions, and the renegotiation of labor agreements or any provisions thereof, or any strikes or work stoppages (including any entered into in connection with any such negotiations), could adversely affect our operations. Approximately 80% of our railroad employees are covered by collective bargaining agreements with various labor unions. In the third and fourth quarters of 2024, the Company reached tentative collective bargaining agreements with ten of these labor unions, a majority of which were subsequently ratified by union membership and became effective January 1, 2025. Future national labor agreements, or renegotiation of labor agreements or provisions of labor agreements, could significantly increase our costs for health care, wages, and other benefits. In addition, if our craft employees were to engage in or threaten a strike, work stoppage, or other slowdown, including in connection with the renegotiation of any collective bargaining agreements or any provisions thereof, we could experience a significant disruption in our operations, customer base, or belief in our ability to provide consistent service, thereby adversely affecting our operations or ability to provide services.

CLIMATE CHANGE RISKS

Severe weather and disasters have caused, and could again cause, significant business interruptions and expenditures. Severe weather conditions and other natural phenomena resulting from changing weather patterns and rising sea levels or other causes, including hurricanes, floods, fires, landslides, extreme temperatures, significant precipitation, and earthquakes, have caused, and may again cause damage to our network, our workforce to be unavailable, and us to be unable to use our equipment, or otherwise cause significant interruptions to our operations. Additionally, shifts in weather patterns caused by climate change are expected to increase the frequency, severity, or duration of certain adverse weather conditions, which could cause more significant business interruptions that result in increased costs, increased liabilities, and decreased revenues. Our inability to quickly and effectively restore operations following adverse weather and disasters could materially impact our business and results of operations. To the extent such weather events or natural disasters become more frequent or severe, disruptions to our business and those of our customers and costs to repair damaged property and equipment or maintain or resume operations could increase. Furthermore, climate change may contribute to an increase in the incidence and severity of natural disasters and adverse weather conditions and reduce the availability or increase the cost of insurance for such events.

Concern over climate change has led to significant federal, state, and international legislative and regulatory efforts to limit greenhouse gas (GHG) emissions. Restrictions, caps, taxes, or other legislative or regulatory controls on GHG emissions, including diesel exhaust, could significantly increase our operating costs and decrease the amount of traffic we handle.

In addition, legislation and regulation related to climate change or GHG emissions could negatively affect the markets we serve and our customers. Even without legislation or regulation, government incentives and adverse publicity relating to climate change or GHG emissions could negatively affect the markets for certain of the commodities we carry, or our customers that use commodities we carry to produce energy (including coal), use significant amounts of energy in producing or delivering the commodities we carry, or manufacture or produce goods that consume significant amounts of energy associated with GHG emissions.

MACROECONOMIC AND MARKET RISKS

We may be negatively impacted by changes in general economic conditions. Because our business is dependent on the rail shipping needs of our customers, negative changes in domestic and global economic conditions,

K18

including reduced import and export volumes, could affect the producers and consumers of the freight we carry. Recessionary economic cycles and downturns in customers’ business cycles, especially in market segments and industries where we have a significant concentration of customers, may substantially reduce our volumes, and lead to excess capacity in the industry, resulting in pressure on rates we are able to obtain for our services. Economic conditions could also result in bankruptcies of one or more of our customers. Changes in general economic conditions are beyond our control, and it may be difficult for us to adjust our business model. We are impacted by industrial production, inflation, unemployment, and consumer spending. We have been and may in the future be, materially impacted by adverse developments in these aspects of the economy.

The state of capital markets could adversely affect our liquidity. We rely on the capital markets to provide some of our capital requirements, including the issuance of debt instruments and the sale of certain receivables. Significant instability or disruptions of the capital markets, including the credit markets, or deterioration of our financial position due to internal or external factors could restrict or eliminate our access to, and/or significantly increase the cost of, various financing sources, including bank credit facilities and issuance of corporate bonds. Instability or disruptions of the capital markets and deterioration of our financial position, alone or in combination, could also result in a reduction of our credit rating to below investment grade, which could prohibit or restrict us from accessing external sources of short- and long-term debt financing and/or significantly increase the associated costs.

None.

CYBERSECURITY RISK MANAGEMENT AND STRATEGY

Process

We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the U.S. Department of Commerce's National Institute of Standards and Technology (NIST). The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters. Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following:

Identify

We identify risks from cybersecurity threats by first developing and maintaining an understanding of those assets essential to our operation and reputation, as well as assets that could provide value to threat actors. Any cyber act is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or its value.

Assess

We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or realize its value, or a threat actor’s ability to gain access to an asset or its value. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation.

Manage

We mitigate risks from cybersecurity threats by applying multiple layers of defense to ensure we have the continued ability to access or utilize an asset or its value, and deny threat actors the ability to gain or increase their access to an asset or its value. We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.

K19

We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.

Integration into our Risk Management Framework

Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework. Technology is one of the five primary risk categories addressed by the ERM framework, and cybersecurity is identified as a subcategory of the technology risk. Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Senior Director of Information Security (SDIS) and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF. Our internal ERM leadership meets regularly with our technology leadership team to review developments in our technology risk profile and works with the cybersecurity team to monitor key risk indicators linked to our cybersecurity risks. Any changes to the threat landscape are discussed and considered as adjustments to our risk profile.

Third-Party Engagement

We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Finance and Risk Management Committee (F&RM Committee) of the Board. These reviews encompass a broad range of areas, including information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor.

Oversight of Third-Party Providers

Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including how our data is stored, accessed, and transmitted. In addition, all providers within these service categories must execute a data security addendum that articulates specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.

Risks

Please see Item 1A. Risk Factors – Technology Risks – “A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations” for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.

As noted therein, regardless of the cause, a significant disruption or failure of one or more information or operational technology systems operated by us or under control of third parties can result in service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data.

Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).

K20

While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation, or financial results. As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.

CYBERSECURITY GOVERNANCE

Board Oversight

The Norfolk Southern Board, both directly itself and indirectly through the F&RM Committee, has oversight of cybersecurity risks. The F&RM Committee receives periodic reports from the CIDO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment. Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results. Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.

The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CIDO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.

Management's Role

Our SDIS, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Such individual has significant relevant experience in the area, including over 27 years of technology experience in various industries with 17 years focused on information security, as well as significant experience working closely with government agencies including the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security. As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, SDIS, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.

Management and Board Reporting

Cybersecurity incidents are reported directly to the SDIS in accordance with the applicable incident response plan. The SDIS, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee. The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.

We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the SDIS and DPO and comprised of other members of management. This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.

K21

In an effort to deter and detect cyber threats, we also periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use, and mobile security and further educates employees on the importance of and process for reporting all potential incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.

For information on our legal proceedings, see Note 18 “Commitments and Contingencies” in Item 8 “Notes to Consolidated Financial Statements.”

Not applicable.

K22

Information About Our Executive Officers

Our executive officers generally are elected and designated annually by the Board at its first meeting held after the annual meeting of stockholders, and they hold office until their successors are elected. Executive officers also may be elected and designated throughout the year as the Board considers appropriate. There are no family relationships among our officers, nor any arrangement or understanding between any officer and any other person pursuant to which the officer was selected. The following table sets forth certain information, at February 1, 2025, relating to our officers.

K23

PART II

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

STOCK INFORMATION

Common Stock is owned by 18,025 stockholders of record as of December 31, 2024, and is traded on the New York Stock Exchange under the symbol “NSC.”

ISSUER PURCHASES OF EQUITY SECURITIES

(1)Of this amount, 478 represent shares tendered by employees in connection with the exercise of stock options under the stockholder-approved Long-Term Incentive Plan (LTIP).

(2)On March 29, 2022, our Board of Directors authorized a new program for the repurchase of up to $10.0 billion of Common Stock beginning April 1, 2022. As of December 31, 2024, $6.9 billion remains authorized for repurchase, until such amount is exhausted.

K24

The following discussion and analysis should be read in conjunction with the Consolidated Financial Statements and Notes. Refer to Item 8 “Notes to Consolidated Financial Statements” for all “Note” references.

OVERVIEW

Since 1827, Norfolk Southern Corporation and its predecessor companies have safely moved the goods and materials that drive the U.S. economy. Our dedicated team members deliver a wide variety of commodities annually for our customers, from agriculture products to consumer goods, and help them reduce carbon emissions by shipping via rail. We have the most extensive intermodal network in the eastern U.S. Our network serves a majority of the country's population and manufacturing base, with connections to every major container port on the Atlantic coast as well as major ports in the Gulf of Mexico and Great Lakes.

In 2024, we executed on various initiatives to operate our network more safely and efficiently, better serve our customers, and increase productivity in order to deliver improved financial performance. We enhanced our executive leadership team and continued to execute on our strategy of providing high-quality service to our customers to enable smart, sustainable growth and delivering on productivity initiatives. Additionally, we executed on several strategic initiatives, including the purchase of the Cincinnati Southern Railway, sales of certain railway lines, and completion of targeted rationalization and restructuring efforts, to further advance our organizational objectives. Furthermore, we continued our efforts related to the Eastern Ohio Incident (as defined and further described in Note 18 in the Notes to the Consolidated Financial Statements), including the pursuit of recoveries under our insurance programs.

Our operational improvements during the year, while handling 5% higher volumes, helped drive improvements to income from railway operations, diluted earnings per share, and railway operating ratio (a measure of the amount of operating revenues consumed by operating expenses). For the full year, we achieved an operating ratio of 66.4%, and an adjusted operating ratio of 65.8% (see our non-GAAP reconciliations beginning on page K26), both of which improved on a year-over-year basis. We remain committed to being a safe, productive, resilient, and efficient railroad with industry-competitive margins.

SUMMARIZED RESULTS OF OPERATIONS

Income from railway operations, net income and diluted earnings per share increased in 2024 compared to 2023, primarily as a result of lower railway operating expenses. The reduction in our operating expenses includes lower net expenses related to the Eastern Ohio Incident and $433 million of gains on the sale of railway lines. Railway operating revenues were slightly lower as decreased fuel surcharge revenue, an adverse mix of traffic, and decreased pricing were nearly offset by increased volumes. Our railway operating ratio improved to 66.4 percent.

Income from railway operations, net income and diluted earnings per share declined in 2023 compared to 2022, driven by expenses incurred with our response efforts to the Incident, lower railway operating revenues, and higher

K25

non-Incident-related railway operating expenses. Railway operating revenues declined 5% due to lower average revenue per unit, the result of lower fuel surcharge revenue and decreased intermodal storage service revenues partially offset by favorable pricing and mix. Additionally, lower volumes contributed to the decline in revenues. Net expenses associated with the Incident for the year 2023 were $1.1 billion. In addition to costs resulting from the Incident, railway operating expenses increased due to inflationary pressures, investments in operational resiliency, and higher service-related costs, offset partially by lower fuel prices. The decline in net income and diluted earnings per share also reflects the absence of a prior year $136 million deferred tax benefit, a result of an enactment of a change in the corporate income tax rate in the Commonwealth of Pennsylvania in 2022. Railway operating ratio deteriorated to 76.5 percent.

The following tables adjust our 2024 and 2023 U.S. Generally Accepted Accounting Principles (GAAP) financial results to exclude gains on railway line sales, restructuring and other charges (including the curtailment gain on our other postretirement benefit plan which is included in “Other income – net”), shareholder advisory costs, and a deferred income tax adjustment, all which occurred in 2024, as well as the effects of the Incident that were present in both years. The income tax effects of these non-GAAP adjustments were calculated based on the applicable tax rates to which the non-GAAP adjustments related. We use these non-GAAP financial measures internally and believe this information provides useful supplemental information to investors to facilitate making period-to-period comparisons by excluding these items. While we believe that these non-GAAP financial measures are useful in evaluating our business, this information should be considered as supplemental in nature and is not meant to be considered in isolation from, or as a substitute for, the related financial information prepared in accordance with GAAP. In addition, these non-GAAP financial measures may not be the same as similar measures presented by other companies.

Showing the first 8K of 70K characters. Open the full section

The information required by this item is included in Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations” under the heading “Market Risks.”

K40

INDEX TO FINANCIAL STATEMENTS

K41

Report of Management

February 10, 2025

To the Stockholders

Norfolk Southern Corporation:

Management is responsible for establishing and maintaining adequate internal control over financial reporting. In order to ensure that Norfolk Southern’s internal control over financial reporting is effective, management regularly assesses such controls and did so most recently as of December 31, 2024. This assessment was based on criteria for effective internal control over financial reporting described in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, management has concluded that we maintained effective internal control over financial reporting as of December 31, 2024.

KPMG LLP, independent registered public accounting firm, has audited our financial statements and issued an opinion on our internal control over financial reporting as of December 31, 2024.

K42

Report of Independent Registered Public Accounting Firm

To the Stockholders and Board of Directors

Norfolk Southern Corporation:

Opinions on the Consolidated Financial Statements and Internal Control Over Financial Reporting

We have audited the accompanying consolidated balance sheets of Norfolk Southern Corporation and subsidiaries (the Company) as of December 31, 2024 and 2023, the related consolidated statements of income, comprehensive income, cash flows, and changes in stockholders’ equity for each of the years in the three-year period ended December 31, 2024, and the related notes and financial statement schedule of valuation and qualifying accounts as listed in Item 15(A)2 (collectively, the consolidated financial statements). We also have audited the Company’s internal control over financial reporting as of December 31, 2024, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2024 and 2023, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 2024, in conformity with U.S. generally accepted accounting principles. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2024 based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Basis for Opinions

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Annual Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company’s consolidated financial statements and an opinion on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting wa

Showing the first 8K of 175K characters. Open the full section

Not applicable.

Disclosure Controls and Procedures

Our Chief Executive Officer and Chief Financial Officer, with the assistance of management, evaluated the effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (Exchange Act)) at December 31, 2024. Based on such evaluation, our officers have concluded that, at December 31, 2024, our disclosure controls and procedures were effective to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, summarized, and reported, within the time period specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including the Chief Executive Officer and the Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Management’s Annual Report on Internal Control Over Financial Reporting

We are responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting includes those policies and procedures that pertain to our ability to record, process, summarize, and report reliable financial data. We recognize that there are inherent limitations in the effectiveness of any internal control over financial reporting, including the possibility of human error and the circumvention or overriding of internal control. Accordingly, even effective internal control over financial reporting can provide only reasonable assurance with respect to financial statement preparation. Further, because of changes in conditions, the effectiveness of internal control over financial reporting may vary over time.

Our Board of Directors, acting through its Audit Committee, is responsible for the oversight of our accounting policies, financial reporting, and internal control. The Audit Committee of our Board of Directors is comprised of outside directors who are independent of management. The independent registered public accounting firm and our internal auditors have full and unlimited access to the Audit Committee, with or without management, to discuss the adequacy of internal control over financial reporting, and any other matters which they believe should be brought to the attention of the Audit Committee.

We have issued a report of our assessment of internal control over financial reporting, and our independent registered public accounting firm has issued an opinion on our internal control over financial reporting at December 31, 2024. These reports appear in Item 8 of this report on Form 10-K.

Changes in Internal Control Over Financial Reporting

During the fourth quarter of 2024, we have not identified any changes in internal control over financial reporting that have materially affected, or are reasonably likely to materially effect, our internal control over financial reporting.

K91

Director and Officer Trading Arrangements

None of our directors or officers (as defined in Rule 16a-1(f) of the Exchange Act) adopted or terminated a contract, instruction or written plan for the purchase or sale of our securities intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) or a non-Rule 10b5-1 trading arrangement (as defined in Item 408(c) of Regulation S-K) during the fourth quarter of 2024.

Not applicable.

K92

PART III

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

In accordance with General Instruction G(3), information called for by Part III, Item 10, is incorporated herein by reference to our definitive Proxy Statement for our 2025 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A. The information regarding executive officers called for by Item 401 of Regulation S-K is included in Part I hereof beginning under “Information about our Executive Officers.”

In accordance with General Instruction G(3), information called for by Part III, Item 11, is incorporated herein by reference to our definitive Proxy Statement for our 2025 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

K93

In accordance with General Instruction G(3), information on security ownership of certain beneficial owners and management called for by Part III, Item 12, is incorporated herein by reference to our definitive Proxy Statement for our 2025 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

Equity Compensation Plan Information (at December 31, 2024)

(1)Excludes securities reflected in column (a).

(2)LTIP.

(3)Includes options, RSUs, and PSUs granted under LTIP that will be settled in shares of Common Stock.

(4)TSOP.

(5)Calculated without regard to 615,643 outstanding RSUs and PSUs at December 31, 2024.

(6)Reflects shares remaining available for grant under TSOP.

Norfolk Southern Corporation Long-Term Incentive Plan

Established on June 28, 1983, and approved by our stockholders at their Annual Meeting held on May 10, 1984, LTIP was adopted to promote the success of our company by providing an opportunity for non-employee Directors, officers, and other key employees to acquire a proprietary interest in Norfolk Southern Corporation (the Corporation). The Board of Directors amended LTIP on January 23, 2015, which amendment was approved by shareholders on May 14, 2015, to include the reservation for issuance of an additional 8,000,000 shares of authorized but unissued Common Stock.

The amended LTIP adopted a fungible share reserve ratio so that, for awards granted after May 13, 2010, the number of shares remaining for issuance under the amended LTIP will be reduced (i) by 1 for each award granted as an option or stock-settled SAR, or (ii) by 1.61 for an award made in the form other than an option or stock-settled SAR. Any shares of Common Stock subject to options, PSUs, restricted shares, or RSUs which are not issued as Common Stock will again be available for award under LTIP after the expiration or forfeiture of an award.

K94

Non-employee Directors, officers, and other key employees residing in the U.S. or Canada are eligible for selection to receive LTIP awards. Under LTIP, the Committee, or the Corporation’s chief executive officer to the extent the Committee delegates award-making authority pursuant to LTIP, may grant incentive stock options, nonqualified stock options, SARs, RSUs, restricted shares, PSUs and performance shares. In addition, dividend equivalent payments may be awarded for options, RSUs and PSUs. Awards under LTIP may be made subject to forfeiture under certain circumstances and the Committee may establish such other terms and conditions for the awards as provided in LTIP.

The option price is at least the higher of (i) the average of the high and low prices at which Common Stock is traded on the date of grant, or (ii) the closing price of Common Stock on the date of the grant. All options are subject to a vesting period of at least one year, and the term of the option will not exceed ten years. LTIP specifically prohibits option repricing without stockholder approval, except that adjustments may be made in the event of changes in our capital structure or Common Stock.

PSUs entitle a recipient to receive performance-based compensation at the end of a three-year cycle based on our performance during that period. For the 2024 PSU awards, corporate performance will be based directly on return on average capital invested, with total return to stockholders and revenue growth serving as modifiers, and will be settled in shares of Common Stock.

RSUs are payable in cash or in shares of Common Stock at the end of a restriction period. During the restriction period, the holder of the RSUs has no beneficial ownership interest in the Common Stock represented by the RSUs and has no right to vote the shares represented by the units or to receive dividends (except for dividend equivalent payment rights that may be awarded with respect to the RSUs). The Committee at its discretion may waive the restriction period, but settlement of any RSUs will occur on the same settlement date as would have applied absent a waiver of restrictions, if no performance goals were imposed. RSUs will be settled in shares of Common Stock.

Norfolk Southern Corporation Thoroughbred Stock Option Plan

Our Board of Directors adopted TSOP on January 26, 1999, to promote the success of our company by providing an opportunity for management employees to acquire a proprietary interest in our company and thereby to provide an additional incentive to management employees to devote their maximum efforts and skills to the advancement, betterment, and prosperity of our company and our stockholders. Under TSOP there were 6,000,000 shares of authorized but unissued Common Stock reserved for issuance. TSOP has not been and is not required to have been approved by our stockholders.

Active full-time management employees residing in the U.S. or Canada are eligible for selection to receive TSOP awards. Under TSOP, the Committee, or the Corporation’s chief executive officer to the extent the Committee delegates award-making authority pursuant to TSOP, may grant nonqualified stock options subject to such terms and conditions as provided in TSOP.

The option price may not be less than the average of the high and low prices at which Common Stock is traded on the date of the grant. All options are subject to a vesting period of at least one year, and the term of the option will not exceed ten years. TSOP specifically prohibits repricing without stockholder approval, except for capital adjustments.

K95

Norfolk Southern Corporation Directors’ Restricted Stock Plan

The Plan was adopted on January 1, 1994, and was designed to increase ownership of Common Stock by our non-employee Directors so as to further align their ownership interest in our company with that of our stockholders. The Plan has not been and is not required to have been approved by our stockholders.

Effective January 23, 2015, the Board amended the Plan to provide that no additional awards will be made under the Plan. Prior to that amendment, only non-employee Directors who are not and never have been employees of our company were eligible to participate in the Plan. Upon becoming a Director, each eligible Director received a one-time grant of 3,000 restricted shares of Common Stock. No additional shares may be granted under the Plan. No individual member of the Board exercised discretion concerning the eligibility of any Director or the number of shares granted.

The restriction period applicable to restricted shares granted under the Plan begins on the date of the grant and ends on the earlier of the recipient’s death or the day after the recipient ceases to be a Director by reason of disability or retirement. During the restriction period, shares may not be sold, pledged, or otherwise encumbered. Directors forfeit the restricted shares if they cease to serve as a Director of our company for reasons other than their disability, retirement, or death.

In accordance with General Instruction G(3), information called for by Part III, Item 13, is incorporated herein by reference to our definitive Proxy Statement for our 2025 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

Our independent registered public accounting firm is KPMG LLP, Atlanta, GA, Auditor Firm ID: 185.

In accordance with General Instruction G(3), information called for by Part III, Item 14, is incorporated herein by reference to our definitive Proxy Statement for our 2025 Annual Meeting of Stockholders, which definitive Proxy Statement will be filed electronically with the SEC pursuant to Regulation 14A.

K96

PART IV

NORFOLK SOUTHERN CORPORATION AND SUBSIDIARIES

K97

K98

K99

K100

K101

K102

K103

K104