Full Breakdown
FERC Implements New Cybersecurity Incentives for U.S. Electric Utilities
10/19/2025, 11:50:24 AM
Overview of the New Rule
In response to the increasing frequency of cyberattacks targeting critical infrastructure, the Federal Energy Regulatory Commission (FERC) has approved a new rule aimed at incentivizing U.S. electric utilities to enhance their cybersecurity measures. This rule allows utilities to earn an additional 50 basis points (0.5%) return on equity for specific cybersecurity investments, a reduction from the initially proposed 200 basis points (2%) outlined in the Notice of Proposed Rulemaking (NOPR) issued on September 22, 2022.
Key Provisions of the Rule
The final rule expands the definition of eligible cybersecurity investments beyond a pre-qualified list to include case-by-case requests from utilities. This flexibility allows utilities to seek incentives for a variety of tailored cybersecurity solutions. Additionally, the rule encourages early compliance with new cybersecurity reliability standards and mandates that expenditures must materially improve a utility's cybersecurity posture. Approved incentives will remain effective for up to five years from the date expenses are incurred, provided the investments are voluntary.
Legislative Context
This regulatory change aligns with directives from Congress under the Infrastructure Investment and Jobs Act of 2021, which called for incentive-based rate treatments to promote investments in advanced cybersecurity technologies. FERC Chairman Willie Phillips emphasized the importance of this initiative, stating, “In today’s highly interconnected world, our nation’s security and economic well-being depend on reliable and cyber-resilient energy infrastructure.”
Criticism and Opposition
While the rule aims to bolster cybersecurity, some critics argue that the reduced incentive of 50 basis points may not be sufficient to motivate utilities to invest in necessary cybersecurity upgrades. Concerns have been raised regarding the adequacy of the incentives in light of the escalating cyber threats facing the energy sector.
Implications for the Energy Sector
The implementation of this rule is expected to have significant implications for the energy sector. By encouraging utilities to invest in cybersecurity, the rule aims to enhance the resilience of the electric grid against cyber threats. As the number of connected devices and the complexity of cyberattacks continue to rise, the need for robust cybersecurity measures becomes increasingly critical.
What's Next
The final rule will take effect 60 days following its publication in the Federal Register. As utilities begin to navigate the new incentives, the effectiveness of these measures in improving cybersecurity across the sector will be closely monitored.
Verbatim Quotes
- “In today’s highly interconnected world, our nation’s security and economic well-being depend on reliable and cyber-resilient energy infrastructure,” — Willie Phillips, Chairman, FERC
- “This project represents the power of collaboration and shared purpose,” — Brad D. Smith, President, Marshall University
This new regulatory framework represents a proactive step toward safeguarding the U.S. energy infrastructure against the growing threat of cyberattacks, reflecting a broader commitment to enhancing national security through improved cybersecurity practices.
