Item E-1
Docket No. RM22-19-000
FERC today issued a final rule providing incentive-based rate treatment for utilities making certain voluntary cybersecurity investments.
Today’s rule follows Congress’ direction under the Infrastructure Investment and Jobs Act of 2021 that the Commission revise its regulations to establish incentive-based rate treatments to encourage utilities to invest in advanced cybersecurity technology and participate in cybersecurity threat information sharing programs for the benefit of consumers.
“In today’s highly interconnected world, our nation’s security and economic well-being depend on reliable and cyber-resilient energy infrastructure,” FERC Chairman Willie Phillips said. “We must continue to build upon the mandatory framework of our cybersecurity reliability standards with efforts such as this to encourage utilities to proactively make additional cybersecurity investments in their systems.”
The final rule largely tracks the Notice of Proposed Rulemaking (NOPR) issued September 22, 2022, but includes some important additions:
- The Commission expanded the definition of eligible cybersecurity investments to include not only a pre-qualified list of cybersecurity investments, but also those investments that are done on a case-by-case basis, allowing utilities to request incentives for a variety of solutions tailored to their specific situations.
- The Commission will allow utilities to seek incentives for early compliance with new cybersecurity reliability standards.
The final rule adopts the NOPR’s proposed requirement that expenditures materially improve a utility’s cybersecurity posture. It also adopts the proposal to allow deferred cost recovery that would enable the utility to defer expenses and include the unamortized portion in its rate base but does not adopt the proposed return on equity adder of 200 basis points. The rule also states that approved incentives, with certain exceptions, will remain in effect for up to five years from the date on which expenses are incurred, provided that the investments remain voluntary.
The final rule takes effect 60 days following publication in the Federal Register.
R23-25