Trending
What We Do
Industries
Solutions
BY Ben Frerichs and Hannah Morrey Brown
As cyberattacks on the electric grid continue to increase, electric utilities and regulators are more aware than ever of the importance of robust cybersecurity. One notable example is Federal Energy Regulatory Commission (FERC) Order No. 893, initiated by direction within the Infrastructure Investment and Jobs Act (IIJA) of 2021. Under this order, FERC introduced new incentives to encourage utilities to take proactive measures to strengthen cybersecurity infrastructure. These incentives are available now to electric utilities.
FERC’s cybersecurity incentives offer financial support to utilities that invest in cybersecurity measures beyond current regulatory requirements. Designed to address evolving cyberthreats, these incentives are part of FERC’s efforts to bolster the security of the electric grid. The program enables utilities to categorize eligible cybersecurity expenditures as regulatory assets, allowing for deferred cost recovery, which can ultimately be factored into the rate base for a return on investment.
The aim is to incentivize investing in advanced cybersecurity technology, operational capabilities and practices, making it more feasible for utilities to address cyberrisks before new regulations mandate these improvements.
There are two types of incentives available:
Both public and nonpublic utilities with a cost-of-service rate on file at FERC are eligible to apply for these incentives. This broad eligibility opens options for a range of utilities that might face unique cybersecurity challenges and want to strengthen their systems with the support of regulatory incentives.
The program is designed to support voluntary investments, so any cybersecurity improvement already mandated by NERC standards, federal laws or other requirements would not qualify for these incentives. This structure encourages utilities to make additional cybersecurity investments that enhance overall security readiness without waiting for new regulations to compel them.
The regulatory asset incentive represents a financial opportunity for utilities to recover the costs associated with increasingly needed cybersecurity upgrades. By categorizing these expenses under regulatory assets, utilities can defer them over several years, adding them to the rate base and potentially improving cash flow and ROI on cybersecurity investments.
For many utilities, cybersecurity can be a significant but necessary expense. FERC’s incentive program opens the door to cost-effective, proactive cybersecurity improvements, which help to protect not only the utility themselves but also the larger infrastructure that depends on a secure and resilient power grid.
Utilities face significant challenges when it comes to operationalizing advanced cybersecurity technologies, particularly in operational technology (OT) environments. A persistent skills gap in OT cybersecurity has made it difficult to recruit and retain the specialized talent needed to implement, monitor and manage these tools effectively. As a result, many utilities are left with understaffed teams, struggling to extract value from their cybersecurity investments. This has also led to tool sprawl, where an overabundance of cybersecurity tools accumulates without proper integration or management, further straining resources.
Recognizing these challenges, FERC’s ruling under Order No. 893 offers a pivotal solution. By extending financial incentives to cover not only advanced technologies but also critical operations and maintenance expenses, including managed services, the ruling enables utilities to adopt a more sustainable and impactful approach to strengthening cybersecurity posture.
FERC’s cybersecurity incentives present a new and timely opportunity for utilities to make meaningful cybersecurity investments while managing costs. By leveraging these incentives, utilities can achieve proactive improvements, preparing their infrastructure against cyberthreats with financial backing. Utilities interested in exploring these incentives further should consider consulting with skilled and experienced industry professionals to make the most of the program and align cybersecurity investments with FERC’s strategic vision.
Vice President | Sales & Marketing
Senior Consultant | Energy Policy
✖