New FERC rule creates incentive-based rate treatment for utilities investing in cybersecurity

A final rule issued by the Federal Energy Regulatory Commission (FERC) last week could encourage the adoption of cybersecurity technology and collaboration among utilities, thanks to its creation of an incentive-based rate treatment.

That treatment will be available to utilities undertaking certain voluntary cybersecurity investments in items such as advanced cybersecurity technology or participating in cybersecurity threat information sharing programs. While a pre-qualified list of cybersecurity investments has been issued, others will be handled on a case-by-case basis, with utilities gaining the ability to request incentives for various solutions to their unique situations. Utilities will also be able to request incentives for early compliance with new cybersecurity reliability standards.

“In today’s highly interconnected world, our nation’s security and economic well-being depend on reliable and cyber-resilient energy infrastructure,” FERC Chairman Willie Phillips said. “We must continue to build upon the mandatory framework of our cybersecurity reliability standards with efforts such as this to encourage utilities to proactively make additional cybersecurity investments in their systems.”

The new rule largely followed Congressional directions from the Infrastructure Investment and Jobs Act of 2021, which called for the Commission to revise its regulations and create incentive-based rate treatments.

Notably, utilities will have to prove their expenditures materially improve their cybersecurity posture. In return, they will be able to defer expenses and include the unamortized portion of their rate base, deferring cost recovery overall. With few exceptions, approved incentives will remain in effect for up to five years from the date on which expenses occur, so long as investments remain voluntary.

This final rule will take effect 60 days after publication in the Federal Register, likely on June 19, 2023.