E-1: Commissioner Phillips Concurrence Regarding Incentives for Advanced Cybersecurity Investment

Docket Nos.  RM22-19-000 and RM21-3-000

I concur in today’s Notice of Proposed Rulemaking[1] to highlight the importance of today’s action and to encourage stakeholder comment in certain areas.  In today’s highly interconnected world, the nation’s security and economic well-being depends on reliable and cyber-resilient energy infrastructure.  This is why it is critical that we continue to build upon the mandatory framework that the industry has already identified through the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards.  But, these mandatory CIP standards are just a baseline and can take years to implement.  Recent cyber-attacks in Ukraine and here at home remind us of the constant threat of foreign and domestic attacks on our critical infrastructure, and the need for advanced and innovative technology and threat information sharing programs for emerging threats.  Therefore, I fully support this action we are taking under section 219A of the Federal Power Act (FPA)[2] to encourage utilities to proactively make additional cybersecurity investments in their systems. 

There are significant costs when there is a cybersecurity breach on the electric or gas system.  Not only are consumers impacted by loss of service, but the recovery costs are significant.  For example, the Colonial Pipeline cybersecurity breach effectively shut down half of the country’s fuel supply, and even though the pipeline invested $200 million dollars over five years to contain a potential attack,[3] Colonial Pipeline still spent millions more to recover from the event in 2021.[4] 

This NOPR serves as a critical step to incent public and non-public utilities to make urgent cybersecurity investments in advanced technology.  First, the NOPR proposes to incentivize expenditures that materially improve the cybersecurity posture of utilities.[5]  Second, the NOPR provides that those cybersecurity investments must not already “be mandated by [CIP] Reliability Standards, or local, state, of federal law.”[6]  Third, the NOPR proposes that the Commission either use a pre-qualified (PQ) list of approved cybersecurity expenditures, where any expenditures that meet the list would be entitled to a rebuttable presumption that the utility is eligible for an incentive,[7] or that the Commission assess expenditures on a case-by-case basis.[8]  Lastly, the NOPR proposes that if a utility meets the requirements for an incentive, it could either receive a return on equity (ROE) adder of 200 basis points or deferred cost recovery for expenditures that enables the utility to defer expenses and include the unamortized portion in rate base.[9]  All of these items are essential to improving utilities’ ability to protect, detect, respond to, and recover from a cybersecurity threat.

Specifically, I am interested in feedback on whether the proposed PQ list is broad enough to include all expenditures that may warrant incentives.  As proposed, if an expense is associated with participation in the Cybersecurity Risk Sharing Program (CRISP)[10] or if an expenditure is associated with internal network security monitoring within the utility’s cyber systems,[11] there would be a rebuttable presumption that that expense is entitled to an incentive.  I agree that each eligible cybersecurity expenditure on the PQ list should have a single, clear, and non-trivial benchmark that must be met for a utility to qualify for incentive rate treatment.  But, the proposed PQ list is limited.  For example, 75% of electricity customers in the continental U.S. are served by investor-owned utilities that already participate in CRISP,[12] which demonstrates the limited potential benefits from this incentive.  Under the NOPR proposal, it is unclear whether a utility that already participates in CRISP could receive an incentive for future subscription costs for continued CRISP participation.  I encourage comments on whether any final rule should clarify that such continued CRISP participation is indeed entitled to an incentive.

I also recognize that a case-by-case approach, as opposed to the proposed PQ list, would be more adaptable and less prescriptive, allowing a variety of solutions that utilities could potentially tailor to their specific situations.  However, given the diverse and evolving nature of cybersecurity activities, this option could be very time-consuming and administratively inefficient.  Thus, I believe that an expanded PQ list is a reasonable approach that would satisfy the applicable statutory directives while providing a high degree of certainty for regulated entities.  I urge all interested stakeholders to provide comments on whether the Commission should widen the PQ list’s universe of potential expenditures.  I especially encourage stakeholders to comment on whether the Commission should consider external penetration tests, a security awareness program, a patch management program, and/or the capability to disconnect operational technology from the information technology network for the PQ list. 

I also want to underscore the need for utilities to conduct analyses of electric and gas interdependencies, and how such actions would benefit cybersecurity on the bulk electric system.  I fully recognize that FPA section 219A states that the Commission can establish “incentive-based, including performance-based, rate treatments for the transmission of electric energy in interstate commerce,”[13] and the Infrastructure Act only modified section 219 regarding incentives and not the Natural Gas Act (NGA).[14]  However, electric and gas companies are especially vulnerable to cyberattacks, particularly because utilities that use both sources have an expansive and increasing attack surface, arising from their geographic and organizational complexity.  Indeed, the electric and gas sector’s unique interdependencies increase their vulnerability to exploitation, which can include the commandeering of the operational-technology system to stop energy infrastructure from working at times when consumers most need it.  To the extent we can identify the need for cybersecurity information sharing between the natural gas and electric systems, and incentivize participation in such a program, I encourage stakeholder comment.

I further urge stakeholders to comment on whether the proposed duration of the incentives is sufficient and whether a 200-basis point adder is reasonable, as the NOPR contemplates.[15]  To be clear, I do not support open-ended or permanent cyber incentives. I believe the 5-year proposed duration and the 200-basis point adder are adequate to properly incent utilities.  Unlike expenses in the traditional transmission incentives context,[16] the dollar amounts in cybersecurity investments are typically small.  Yet, the benefits of additional, advanced cybersecurity investments cannot be ignored.  Offering anything less than what is proposed would likely be insufficient to incent any action by utilities, as required by Congress.  Therefore, commenters should provide specific, compelling reasons if they oppose the NOPR proposal regarding the duration of the incentive and the amount added to a utility’s ROE.

Finally, I note that for years now, the White House, the U.S. Congress, and senior government leaders have sounded the alarm on increasing cybersecurity threats and their sophistication.[17]  I also note that the Commission began assessing the potential use of incentives to improve cybersecurity prior to the passage of the Infrastructure Act.[18]  While we are terminating the proceeding in Docket No. RM21-3-000, I am heartened that the Commission remains committed to this issue.  I look forward to examining all the comments as we seek to issue a final rule around these topics.

For these reasons, I respectfully concur.