The Federal Energy Regulatory Commission (FERC) has issued a final rule providing incentive-based rate treatment for utilities investing in cybersecurity voluntarily.
The rule follows Congress’ direction under the Infrastructure Investment and Jobs Act of 2021 for the Commission to revise its regulations to establish incentive-based rate treatments to encourage utilities to invest in advanced cybersecurity technology and participate in cybersecurity threat information sharing programs for the benefit of consumers.
The final rule tracks the Notice of Proposed Rulemaking (NOPR) issued on September 22, 2022, and includes some important additions:
- The Commission expanded the definition of eligible cybersecurity investments to include not only a pre-qualified list of cybersecurity investments, but also the investments done on a case-by-case basis, allowing utilities to request incentives for a variety of solutions tailored to their specific situations.
- The Commission will allow utilities to seek incentives for early compliance with new cybersecurity reliability standards.
The final rule adopts the NOPR’s proposed requirement for expenditures to materially improve a utility’s cybersecurity posture. While, the rule approves the proposal to allow deferred cost recovery helping the utility to defer expenses and include the unamortized portion in its rate base, it does not adopt the proposed return on equity adder of 200 basis points.
The rule also stated that approved incentives, with certain exceptions, will remain in effect for up to five years from the date on which expenses are incurred, provided the investments are voluntary. The final rule is effective 60 days after publication in the Federal Register.
