On April 20, 2023, the FERC approved a final rule that provides incentive-based rate treatment for utilities making certain voluntary cybersecurity investments. Under the Infrastructure Investment and Jobs Act of 2021, Congress directed the FERC to update its regulations to establish incentive-based rate treatments, encouraging utility companies to invest in advanced cybersecurity technology. The act also directs the FERC to participate in cybersecurity information-sharing programs, which would protect and benefit consumers.
Though the final rule closely follows the September 2022 Notice of Proposed Rulemaking, it now includes the following significant additions and changes:
- The FERC broadened the definition of eligible cybersecurity investments to include investments that are done on an individual basis, allowing utilities to request incentives for a variety of solutions tailored to their specific situations
- The FERC will allow utilities to seek incentives for early compliance with new cybersecurity reliability standards
- The rule adopts the proposed requirement that expenditures materially improve a utility’s cybersecurity posture
- The rule adopts the proposal to allow deferred cost recovery that would enable the utility to defer expenses and include the unamortized portion in its rate base but does not adopt the proposed return on equity adder of 200 basis points
- The rule adopts incentives that (with certain exceptions) will remain in effect for up to five years from the date on which expenses are incurred, provided that the investments remain voluntary
The final rule goes into effect 60 days after its publication in the Federal Register.
Source:
FERC Approves Incentive Rate Treatment for Cybersecurity Investments (ferc.gov)
