§824s–1 Incentives for Cybersecurity Investments

Summary

The Commission must study and then create rules that give utilities financial incentives to buy better cybersecurity and to share cyber threat information. The study had to start within 180 days after November 15, 2021, and the Commission must finish rules within 1 year after the study ends. For the study the Commission must work with the Secretary of Energy, the North American Electric Reliability Corporation, the Electricity Subsector Coordinating Council, and the National Association of Regulatory Utility Commissioners. The rules cover incentives for transmission and wholesale sales of electricity across state lines that aim to help consumers by encouraging those investments and information sharing. "Advanced cybersecurity technology" means hardware, software, services, or related capabilities that improve a utility’s ability to defend, detect, respond, or recover from cyber threats. "Advanced cybersecurity technology information" means information about such technology given to or made by the Commission or other federal agencies. The Commission can add extra incentives when investments cut risks to defense-critical or other safety‑ or security‑important facilities (after consulting the Secretary of Energy, the Secretary of Homeland Security, and other agencies) and to small or medium utilities. Any approved rates must be just and reasonable and not unfairly discriminatory under sections 824d and 824e, must prevent double recovery, allow single-issue tariff filings to recover costs over an asset’s depreciable life, and treat submitted cyber information as critical electric infrastructure information under section 824o–1.