The Federal Energy Regulatory Commission on April 21 issued a final rule providing incentive-based rate treatment for utilities making certain voluntary cybersecurity investments.
The final rule follows Congress’ direction under the Infrastructure Investment and Jobs Act of 2021 that the Commission revise its regulations to establish incentive-based rate treatments to encourage utilities to invest in advanced cybersecurity technology and participate in cybersecurity threat information sharing programs for the benefit of consumers.
In response to the notice of proposed rulemaking that preceded the final rule, APPA urged FERC to reconsider several aspects of the NOPR, including a proposal to allow a 200-basis point return on equity adder on eligible investments.
FERC said that the final rule largely tracks the Notice of Proposed Rulemaking issued September 22, 2022.
However, it also includes some important additions, the Commission said.
Specifically, the Commission expanded the definition of eligible cybersecurity investments to include not only a pre-qualified list of cybersecurity investments, but also those investments that are made on a case-by-case basis, allowing utilities to request incentives for a variety of solutions tailored to their specific situations.
The Commission will also allow utilities to seek incentives for early compliance with new cybersecurity reliability standards.
The final rule adopts the NOPR’s proposed requirement that expenditures materially improve a utility’s cybersecurity posture.
It also adopts the proposal to allow deferred cost recovery that would enable the utility to defer expenses and include the unamortized portion in its rate base, but does not adopt the proposed return on equity adder of 200 basis points.
The rule also states that approved incentives, with certain exceptions, will remain in effect for up to five years from the date on which expenses are incurred, provided that the investments remain voluntary.
The final rule takes effect 60 days following publication in the Federal Register.
Commissioner Danly Dissents
FERC Commissioner James Danly dissented from the final rule.
He said the final rule is not in line with the Infrastructure Investment and Jobs Act directive to establish incentive-based rate treatments that encourage investments by utilities in advanced cybersecurity technology and participation by utilities in cybersecurity threat information
