[Federal Register Volume 88, Number 85 (Wednesday, May 3, 2023)]
[Rules and Regulations]
[Pages 28348-28380]
[FR Doc No: 2023-08929]

Vol. 88

Wednesday,

No. 85

May 3, 2023

Part VI

Department of Energy

-----------------------------------------------------------------------

Federal Energy Regulatory Commission

18 CFR Part 35

Incentives for Advanced Cybersecurity Investment; Final Rule

Federal Register / Vol. 88 , No. 85 / Wednesday, May 3, 2023 / Rules
and Regulations

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

18 CFR Part 35

[Docket No. RM22-19-000; Order No. 893]

Incentives for Advanced Cybersecurity Investment

AGENCY: Federal Energy Regulatory Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Energy Regulatory Commission is revising its
regulations to provide incentive-based rate treatment for the
transmission of electric energy in interstate commerce and the sale of
electric energy at wholesale in interstate commerce by utilities for
the purpose of benefitting consumers by encouraging investments by
utilities in Advanced Cybersecurity Technology and participation by
utilities in cybersecurity threat information sharing programs, as
directed by the Infrastructure Investment and Jobs Act of 2021.

DATES: This rule is effective July 3, 2023.

FOR FURTHER INFORMATION CONTACT:
David DeFalaise (Technical Information), Office of Electric
Reliability, Federal Energy Regulatory Commission, 888 First Street NE,
Washington, DC 20426,<PHONE_NUMBER>, [email protected].
Ryan Maca (Technical Information), Office of Energy Infrastructure
Security, Federal Energy Regulatory Commission, 888 First Street NE,
Washington, DC 20426,<PHONE_NUMBER>, [email protected].
Adam Pollock (Technical Information), Office of Energy Market
Regulation, Federal Energy Regulatory Commission, 888 First Street NE,
Washington, DC 20426,<PHONE_NUMBER>, [email protected].
Alan J. Rukin (Legal Information), Office of the General Counsel,
Federal Energy Regulatory Commission, 888 First Street NE, Washington,
DC 20426,<PHONE_NUMBER>, [email protected].

SUPPLEMENTARY INFORMATION:

                            TABLE OF CONTENTS

                                                              Paragraph
                                                               numbers

I. Introduction............................................            1
II. Background.............................................            3
    A. Infrastructure Investment and Jobs Act of 2021......            3
        1. Advanced Cybersecurity Technology...............            4
        2. Cybersecurity Threat Information Sharing                    7
         Programs..........................................
    B. Study and Report to Congress........................            8
    C. NOPR................................................           10
III. Discussion............................................           17
    A. Cybersecurity Investments...........................           18
        1. Utilities Eligible To Request Rate Incentives              19
         for Cybersecurity Investments.....................
        2. Cybersecurity Investment Definitions............           27
        3. Cybersecurity Investment Eligibility Criteria...           28
    B. Cybersecurity Investment Incentive Requests.........           54
        1. PQ List Approach................................           55
        2. Case-by-Case Approach...........................          100
        3. Early Compliance With Approved Reliability                112
         Standards.........................................
    C. Cybersecurity Investment Rate Incentives............          120
        1. Cybersecurity ROE Incentive.....................          122
        2. Cybersecurity Regulatory Asset Incentive........          135
        3. Performance-Based Rates.........................          155
    D. Cybersecurity Investment Incentive Implementation...          161
        1. Cybersecurity ROE Incentive Duration............          161
        2. Cybersecurity Regulatory Asset Incentive                  165
         Duration and Amortization Period..................
        3. Filing Process..................................          174
        4. Reporting Requirements..........................          192
    E. Other Issues........................................          204
        1. Comments........................................          204
        2. Commission Determination........................          206
IV. Information Collection Statement.......................          207
V. Environmental Analysis..................................          213
VI. Regulatory Flexibility Act.............................          214
VII. Document Availability.................................          215
VIII. Effective Date and Congressional Notification........          218

I. Introduction

    1. In this final rule, the Federal Energy Regulatory Commission
revises its regulations pursuant to section 219A of the Federal Power
Act (FPA) \1\ to add subpart K, consisting of Sec.  35.48, to our
regulations to establish rules for incentive-based rate treatment for
certain voluntary cybersecurity investments \2\ by utilities \3\ as
described in this final rule. These rules make incentive-based rate
treatment available to utilities that make voluntary cybersecurity
investments in Advanced Cybersecurity Technology \4\ that

enhance their security posture by improving their ability to protect
against, detect, respond to, or recover from a cybersecurity threat and
to utilities that participate in cybersecurity threat information
sharing programs. The Commission is issuing this final rule to comply
with FPA section 219A(c).\5\ This voluntary cybersecurity incentive-
based rate treatment is for the purpose of benefitting consumers by
encouraging cybersecurity investments in Advanced Cybersecurity
Technology and in participation in cybersecurity threat information
sharing programs.\6\
---------------------------------------------------------------------------

    \1\ Infrastructure Investment and Jobs Act of 2021, Public Law
117-58, section 40123, 135 Stat. 429, 951 (to be codified at 16
U.S.C. 824s-1) (IIJA).
    \2\ In this final rule, the term investments includes
expenditures that can be either capitalized costs or expenses.
    \3\ Notwithstanding that FPA section 219A requires the
Commission to offer incentives to public utilities, as discussed in
section III.A.1. of this final rule, we make rate incentives also
available to non-public utilities that have or will have a rate on
file with the Commission, similar to Commission precedent under FPA
section 219, 16 U.S.C. 824s. We intend that all references in this
final rule to utilities include both public utilities and non-public
utilities that have or will have a rate on file with the Commission.
    \4\ FPA section 219A(a)(1) defines the term Advanced
Cybersecurity Technology to mean any technology, operational
capability, or service, including computer hardware, software, or a
related asset, that enhances the security posture of public
utilities through improvements in the ability to protect against,
detect, respond to, or recover from a cybersecurity threat. IIJA,
Public Law 117-58, section 40123, 135 Stat. at 951 (to be codified
at 16 U.S.C. 824s-1(a)(1)). FPA section 219A(a)(2) defines the term
Advanced Cybersecurity Technology Information to mean information
relating to advanced cybersecurity technology or proposed advanced
cybersecurity technology that is generated by or provided to the
Commission or another Federal agency. Id. at 952 (to be codified at
16 U.S.C. 824s-1(a)(2)).
    \5\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 952 (to
be codified at 16 U.S.C. 824s-1(c)).
    \6\ Id.
---------------------------------------------------------------------------

    2. We establish a regulatory framework for utilities to request
incentive-based rate treatment for certain voluntary cybersecurity
investments.\7\ Under this framework, we: (1) identify the utilities
permitted to request incentive-based rate treatment for cybersecurity
investments; (2) establish the criteria that the Commission will use to
determine whether a cybersecurity investment is eligible to receive an
incentive-based rate treatment; (3) discuss the approaches that a
utility may use to demonstrate that a cybersecurity investment
satisfies the eligibility criteria; (4) explain the types of incentive-
based rate treatments available for qualifying cybersecurity
investments; (5) set limits on the duration of the incentive-based rate
treatment; (6) describe what utilities must include in their
applications for incentive-based rate treatment for cybersecurity
investments; and (7) establish the annual reporting requirements for
utilities that receive incentive-based rate treatment for their
cybersecurity investments.
---------------------------------------------------------------------------

    \7\ Incentives for Advanced Cybersecurity Investment, Notice of
Proposed Rulemaking, 87 FR 60567 (Oct. 6, 2022), 180 FERC ] 61,189
(2022) (NOPR).
---------------------------------------------------------------------------

II. Background

A. Infrastructure Investment and Jobs Act of 2021

    3. On November 15, 2021, the IIJA was signed into law.\8\ Section
40123 of the IIJA added section 219A to the FPA, which directs the
Commission to revise its regulations to establish, by rule, incentive-
based, including performance-based, rate treatments for the
transmission of electric energy in interstate commerce and the sale of
electric energy at wholesale in interstate commerce by public utilities
for the purpose of benefitting consumers by encouraging investments by
public utilities in Advanced Cybersecurity Technology and participation
by public utilities in cybersecurity threat information sharing
programs.
---------------------------------------------------------------------------

    \8\ IIJA, Public Law 117-58, 135 Stat. 429.
---------------------------------------------------------------------------

1. Advanced Cybersecurity Technology
    4. Under FPA section 219A(a), an Advanced Cybersecurity Technology
can be a product and/or a service.\9\ Cybersecurity products are
generally hardware, software, and cybersecurity services that can be
used for information technology (IT) systems and/or operational
technology (OT) systems.\10\ Cybersecurity products can include, but
are not limited to, security information and event management systems,
intrusion detection systems, anomaly detection systems, encryption
tools, data loss prevention systems, forensic toolkits, incident
response tools, imaging tools, network behavior analysis tools, access
management systems, configuration management systems, anti-malware
tools, user behavior analytic software, event logging systems, and any
system for access control, identification, authentication, and/or
authorization control.
---------------------------------------------------------------------------

    \9\ Id. at 952 (to be codified at 16 U.S.C. 824s-1(c)).
    \10\ The National Institute of Standards and Technology (NIST)
glossary defines OT to mean programmable systems or devices that
interact with the physical environment (or manage devices that
interact with the physical environment). These systems/devices
detect or cause a direct change through the monitoring and/or
control of devices, processes, and events. Examples include
industrial control systems, building management systems, fire
control systems, and physical access control mechanisms. NIST,
Computer Security Resource Center, Glossary (Mar. 10, 2022), https://csrc.nist.gov/glossary.
---------------------------------------------------------------------------

    5. Cybersecurity services may be either automated or manual and can
include, but are not limited to, system installation and maintenance,
network administration, asset management, threat and vulnerability
management, training, incident response, forensic investigation,
network monitoring, data sharing, data recovery, disaster recovery,
network restoration, log analytics, cloud network storage, and any
general cybersecurity consulting service.
    6. Under FPA section 219A(a), Advanced Cybersecurity Technology
Information may include, but is not limited to, plans, policies,
procedures, specifications, implementation, configuration, manuals,
instructions, accounting, financials, logs, records, and physical or
electronic access lists related to or regarding the Advanced
Cybersecurity Technology. FPA section 219A(g) states that Advanced
Cybersecurity Technology Information that is provided to, generated by,
or collected by the Federal Government under FPA section 219A
subsections (b), (c), or (f) shall be considered to be critical
electric infrastructure information under FPA section 215A.\11\
Utilities submitting to the Commission Advanced Cybersecurity
Technology Information or other information they believe to be Critical
Energy/Electric Infrastructure Information (CEII) must clearly indicate
which portions of their filing contains CEII and provide public and
non-public versions of the information pursuant to the Commission's
regulations.\12\
---------------------------------------------------------------------------

    \11\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 952
(to be codified at 16 U.S.C. 824s-1(g)) (citing 16 U.S.C. 824o-1).
    \12\ See 18 CFR 388.113(d)(1)(i)-(ii).
---------------------------------------------------------------------------

2. Cybersecurity Threat Information Sharing Programs
    7. FPA section 219A(c) directs the Commission to identify
incentive-based rate treatments that could support participation by
public utilities in cybersecurity threat information sharing programs.
Utilities face barriers to participating in cybersecurity information
sharing programs, such as the high costs associated with implementing
monitoring technology and maintenance of sensor technology, the amount
of time and effort required to share information, incurring fees to
participate in cybersecurity threat information sharing programs, and
concerns regarding the confidentiality of the information once shared.

B. Study and Report to Congress

    8. As an initial step in the process of revising the Commission's
regulations, FPA section 219A(b) requires the Commission to conduct a
study, in consultation with certain entities,\13\ to identify
incentive-based rate treatments, including performance-based rates, for
the jurisdictional transmission and sale of electric energy that could
support investments in Advanced Cybersecurity Technology and
participation by public utilities in cybersecurity threat

information sharing programs.\14\ As directed, Commission staff
consulted with the specified entities to help identify incentive-based
rate treatments that could enhance the security posture of the Bulk-
Power System.\15\
---------------------------------------------------------------------------

    \13\ FPA section 219A(b) identifies the following entities: the
Secretary of Energy; North American Electric Reliability Corporation
(NERC); Electricity Subsector Coordinating Council (ESCC); and
National Association of Regulatory Utility Commissioners (NARUC).
    \14\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 952
(to be codified at 16 U.S.C. 824s-1(b)).
    \15\ The term Bulk-Power System is defined in FPA section 215
and refers to: (1) facilities and control systems necessary for
operating an interconnected electric energy transmission network (or
any portion thereof); and (2) electric energy from generation
facilities needed to maintain transmission system reliability. 16
U.S.C. 824o(a)(1). In the context of developing and determining the
applicability of mandatory Reliability Standards, NERC uses the term
bulk electric system, which NERC defines to generally include the
transmission facilities that are operated at 100 kV or higher and
real power or reactive power resources connected at 100 kV or
higher. See NERC, Glossary of Terms Used in NERC Reliability
Standards (Mar. 8, 2023), https://www.nerc.com/pa/Stand/Glossary%20of%20Terms/Glossary_of_Terms.pdf (NERC Glossary).
---------------------------------------------------------------------------

    9. In addition to conducting the study, FPA section 219A(b)
requires the Commission to submit a report to Congress (Report)
detailing the results of the study. On May 13, 2022, the Report was
submitted to Congress.\16\ The Report, among other things, outlined
prior Commission efforts to address incentives for cybersecurity
initiatives. The Report provided information regarding potential
incentive-based rate treatments and the Commission's general ratemaking
authority, including the prior adoption of rate incentives and
performance-based ratemaking in other contexts. In addition, the Report
discussed challenges associated with adopting an incentive-based rate
structure to enhance the security posture of the Bulk-Power System.
---------------------------------------------------------------------------

    \16\ FERC, Incentives for Advanced Cybersecurity Technology
Investment (May 2022).
---------------------------------------------------------------------------

C. NOPR

    10. On September 22, 2022, the Commission issued the NOPR in this
proceeding, proposing under FPA section 219A to establish rules for
incentive-based rate treatments for certain voluntary cybersecurity
investments by utilities.\17\ The Commission proposed that these rules
would make incentives available to utilities that make certain
cybersecurity investments that enhance their security posture by
improving their ability to protect against, detect, respond to, or
recover from a cybersecurity threat, or that participate in
cybersecurity threat information sharing programs to the benefit of
ratepayers and national security.
---------------------------------------------------------------------------

    \17\ NOPR, 180 FERC ] 61,189 at P 1.
---------------------------------------------------------------------------

    11. First, the Commission proposed a regulatory framework for how a
utility could qualify for incentives for eligible cybersecurity
investments.\18\ Under this framework, the Commission proposed that
eligible cybersecurity investments must: (1) materially improve
cybersecurity through either an investment in Advanced Cybersecurity
Technology or participation in a cybersecurity threat information
sharing program; \19\ and (2) not already be mandated by Critical
Infrastructure Protection (CIP) Reliability Standards, or local, State,
or Federal law.\20\ The Commission proposed that a utility would seek
incentive-based rate treatment for a cybersecurity investment in a
filing pursuant to FPA section 205,\21\ and that the incentive would be
effective no earlier than the date of the Commission order approving
the incentive request.\22\
---------------------------------------------------------------------------

    \18\ Id. P 2.
    \19\ Id. PP 20-22.
    \20\ Id.
    \21\ 16 U.S.C. 824d. The Commission noted that a utility would
be permitted to first file a petition for declaratory order to seek
a Commission determination on its eligibility for an incentive, but
the utility would still need to make a filing with the Commission
pursuant to FPA section 205 before adding the incentive-based rate
treatment to its rate on file with the Commission.
    \22\ NOPR, 180 FERC ] 61,189 at P 24.
---------------------------------------------------------------------------

    12. Second, the Commission proposed to evaluate cybersecurity
investments using a list of pre-qualified expenditures that are
determined by the Commission to be eligible for incentives, which would
be posted on the Commission's public website (PQ List).\23\ The
Commission proposed that any cybersecurity investment that is on the PQ
List would be entitled to a rebuttable presumption of eligibility for
an incentive.\24\ With the Commission having evaluated cybersecurity
investments to include on the PQ List in advance of the application for
incentive-based rate treatment, along with the rebuttable presumption,
the Commission postulated that the PQ List approach would provide an
efficient and transparent mechanism for determining appropriate
cybersecurity investments that are eligible for incentives.\25\ The
Commission also discussed and sought comment on a potential alternative
approach, whereby a utility's cybersecurity investment would be
evaluated on a case-by-case basis to determine if it is eligible for an
incentive.\26\
---------------------------------------------------------------------------

    \23\ Id. P 25.
    \24\ Id. P 26.
    \25\ Id. P 27.
    \26\ Id. P 32.
---------------------------------------------------------------------------

    13. Third, the Commission proposed two potential cybersecurity
incentives: (1) a return on equity (ROE) adder of 200 basis points
(Cybersecurity ROE Incentive); \27\ and (2) deferred cost recovery for
certain cybersecurity investments that enables the utility to defer
expenses and include the unamortized portion in its rate base
(Cybersecurity Regulatory Asset Incentive).\28\
---------------------------------------------------------------------------

    \27\ Id. P 36.
    \28\ Id. P 39.
---------------------------------------------------------------------------

    14. Fourth, the Commission proposed that any approved incentive(s)
would remain in effect for five years from the date on which the
cybersecurity investment(s) enters service or the expenses are
incurred, or expire earlier if certain other conditions discussed in
the NOPR are met before the end of that five year period, e.g., the
cybersecurity investment becomes mandatory.\29\ For continued voluntary
participation in a cybersecurity threat information sharing program,
however, the Commission proposed that utilities be able to continue
deferring these expenses and including them in their rate base for each
annual tranche of expenses, for as long as: (1) the utility continues
incurring costs for its participation in the program; and (2) the
program remains eligible for incentives.\30\ The Commission sought
comment on the proposed duration and expiration conditions for
incentives granted under this proposal.
---------------------------------------------------------------------------

    \29\ Id. PP 46-49.
    \30\ Id. P 49.
---------------------------------------------------------------------------

    15. Finally, the Commission proposed that a utility receiving a
cybersecurity incentive pursuant to the proposed rule must make an
annual informational filing by June 1 of each year following the
receipt of incentive for as long as the utility receives the
incentive.\31\ The Commission proposed that the annual filing should
detail the specific cybersecurity investments that were made pursuant
to the Commission's approval and the corresponding FERC account
used.\32\
---------------------------------------------------------------------------

    \31\ Id. PP 54-56.
    \32\ See 18 CFR pt. 141.
---------------------------------------------------------------------------

    16. The initial comment period for the NOPR ended on November 7,
2022, and the Commission received 27 initial comments. The reply
comment period for the NOPR ended on November 21, 2022, and the
Commission received six reply comments.

III. Discussion

    17. To implement the statutory directive in FPA section 219A, we
add subpart K to our regulations, consisting of Sec.  35.48, to
establish the rules for incentive-based rate treatment for utilities
that voluntarily make cybersecurity investments as described in this
final rule. For this final rule, a

cybersecurity investment includes both expenses and capitalized costs
associated with Advanced Cybersecurity Technology and participation in
a cybersecurity threat information sharing program. In this final rule
we: (1) identify the utilities permitted to request incentive-based
rate treatment for cybersecurity investments; (2) establish the
criteria that the Commission will use to determine whether a
cybersecurity investment is eligible to receive an incentive-based rate
treatment; (3) discuss the approaches that a utility may use to
demonstrate that a cybersecurity investment satisfies the eligibility
criteria; (4) explain the type of incentive-based rate treatment
available for qualifying cybersecurity investments; (5) set limits on
the duration of the incentive-based rate treatment; (6) describe what
utilities must include in their applications for incentive-based rate
treatment for cybersecurity investments; and (7) establish the annual
reporting requirements for utilities that receive incentive-based rate
treatment for their cybersecurity investments.

A. Cybersecurity Investments

    18. We establish a structure that allows certain entities to
request rate incentives for cybersecurity investments that satisfy the
eligibility criteria. First, we determine which utilities may request
the cybersecurity incentives. Next, we add definitions that identify
the types of investments for which those utilities could seek
incentive-based rate treatment. Finally, we establish the eligibility
criteria that the Commission will use to determine whether a
cybersecurity investment is eligible for an incentive.
1. Utilities Eligible To Request Rate Incentives for Cybersecurity
Investments
    19. FPA section 219A(c) directs the Commission to establish, by
rule, incentive-based rate treatment for the transmission of electric
energy in interstate commerce and the sale of electric energy at
wholesale in interstate commerce by public utilities for the purpose of
benefiting consumers by encouraging cybersecurity investments.\33\
---------------------------------------------------------------------------

    \33\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 952
(to be codified at 16 U.S.C. 824s-1(c)).
---------------------------------------------------------------------------

a. NOPR Proposal
    20. In the NOPR, the Commission proposed to make rate incentives
available to both public utilities as well as non-public utilities that
have or will have a rate on file with the Commission, similar to
Commission precedent regarding transmission incentives under FPA
section 219.\34\ The Commission explained that it intended that all
references to utilities in the NOPR would include both public utilities
and non-public utilities that have or will have a rate on file with the
Commission.
---------------------------------------------------------------------------

    \34\ NOPR, 180 FERC ] 61,189 at P 1 n.3 (citing 16 U.S.C. 824s).
---------------------------------------------------------------------------

b. Comments
    21. Some commenters discuss the utilities that should or should not
be eligible for cybersecurity incentives. American Public Power
Association (APPA) agrees with the NOPR proposal that non-public
utilities with rates on file with the Commission should be eligible to
receive incentives for qualifying investments.\35\ Electric Power
Supply Association (EPSA) also supports the proposal and argues that
the statutory language in FPA section 219A requires the Commission to
extend the proposed incentives to all utilities whose rates are
regulated by the Commission, including those utilities who recover
their costs through competitive markets.\36\
---------------------------------------------------------------------------

    \35\ APPA Initial Comments at 6.
    \36\ EPSA Initial Comments at 6-7.
---------------------------------------------------------------------------

    22. EPSA contends that Congress did not intend to limit
cybersecurity incentives to utilities with cost-of-service rates on
file with the Commission, but rather intended to make incentive-based
rates available to all utilities, including those with market-based
rates.\37\ EPSA specifically suggests that the Commission establish
formula rates for costs associated with identified incented
cybersecurity investments. Alternatively, EPSA suggests allowing
market-based rate entities to make FPA section 205 filings to recover
the costs of eligible cybersecurity investments.\38\ In contrast,
California Public Utilities Commission and the California Department of
Water Resources State Water Project (California Parties) suggest that
market-based rate sellers or generators should not be eligible for
incentives, so as to avoid interference with competitive markets.\39\
Transmission Access Policy Study Group (TAPS) states that the
Commission should explicitly exclude generators with market-based rates
from incentive eligibility.\40\ APPA urges the Commission to clarify in
the final rule that its proposed incentives are limited to cost-based
rates and not available for wholesale sales made under market-based
rate authority.\41\
---------------------------------------------------------------------------

    \37\ Id. at 6.
    \38\ Id. at 8.
    \39\ California Parties Reply Comments at 13.
    \40\ TAPS Initial Comments at 26-27.
    \41\ APPA Initial Comments at 22.
---------------------------------------------------------------------------

c. Commission Determination
    23. We adopt the NOPR proposal to permit public utilities and non-
public utilities that have or will have a rate on file with the
Commission to seek incentive-based rate treatment for their eligible
cybersecurity investments.\42\
---------------------------------------------------------------------------

    \42\ NOPR, 180 FERC ] 61,189 at P 1 n.3.
---------------------------------------------------------------------------

    24. We add Sec.  35.48(a) to our regulations, which declares that
the purpose of this section is to establish rules for incentive-based
rate treatment for utilities with rates on file with the Commission
that voluntarily make cybersecurity investments. In doing so, we adopt
the NOPR proposal to allow utilities described in FPA section 201(f)
\43\ that have or will have a rate on file with the Commission to be
eligible to receive incentives for cybersecurity investments in the
same manner as public utilities. Accordingly, we add Sec.  35.48(c) to
our regulations, which states that the Commission will authorize
incentive-based rate treatment to public and non-public utilities that
have or will have a rate on file with the Commission for their
voluntary cybersecurity investments, provided that the resulting rate
is just and reasonable and not unduly discriminatory or preferential.
---------------------------------------------------------------------------

    \43\ 16 U.S.C. 824(f).
---------------------------------------------------------------------------

    25. In FPA section 219A(c), Congress directs the Commission to
offer incentive-based rate treatment for both the transmission of
electric energy in interstate commerce and the sale of electric energy
at wholesale in interstate commerce. This rulemaking satisfies the
statutory requirement of providing the opportunity for public and non-
public utilities to file to seek authorization to recover the cost of
and receive incentive-based rate treatment on eligible cybersecurity
investments.
    26. We disagree with EPSA's contentions that utilities that make
sales of energy, capacity, or ancillary services at market-based rates
should be able to continue to make those sales and also separately
recover the costs of, and receive incentive-based rate treatment on,
eligible cybersecurity investments. The Incentive permitted in this
final rule may only be recovered through a cost-of-service rate. As
noted above, the ability to seek incentive-based rate treatment under
this final rule meets the requirements of FPA section 219A.\44\ All

sellers of energy, capacity, and ancillary services are free to file
cost-of-service rates under FPA section 205. Thus, we note that
utilities currently making sales of energy, capacity, and ancillary
services under market-based rate authority may make a filing to recover
their entire cost of service, including costs of and an incentive on,
eligible cybersecurity investments and proceed to make sales
exclusively under that cost-based rate.\45\
---------------------------------------------------------------------------

    \44\ The dissent's criticism correctly notes that FPA section
219A is designed to provide incentives for certain cybersecurity
investments. However, FPA section 219A also requires the Commission
to determine that any rate approved under this rule be just and
reasonable, not unduly discriminatory or preferential. IIJA, Public
Law 117-58, section 40123, 135 Stat. at 952 (to be codified at 16
U.S.C. 824s-1(e)). We agree with TAPS that the recovery of costs and
an incentive as set forth in this final rule is not compatible with
making sales at market-based rates. Therefore, our decision on this
issue seeks to give meaning to all of the provisions of FPA section
219A.
    \45\ Cf. PJM Interconnection, L.L.C., 178 FERC ] 61,121, at P
115 (2022) (noting generators' ability to choose between selling
capacity at cost-based or market-based rates).
---------------------------------------------------------------------------

2. Cybersecurity Investment Definitions
    27. The cybersecurity investments eligible for incentives could
include investments in Advanced Cybersecurity Technology, voluntary
participation in a cybersecurity threat information sharing program, or
both. Accordingly, we add Sec.  35.48(b) to our regulations to define
these and other terms used in that section. We incorporate the
definitions of Advanced Cybersecurity Technology and Advanced
Cybersecurity Technology Information in FPA section 219A(a).\46\
Therefore, we define Advanced Cybersecurity Technology as any
technology, operational capability, or service, including computer
hardware, software, or a related asset, that enhances the security
posture of public utilities through improvements in the ability to
protect against, detect, respond to, or recover from a cybersecurity
threat (as defined in section 102 of the Cybersecurity Act of 2015 (6
U.S.C. 1501)).\47\ We define Advanced Cybersecurity Technology
Information as information relating to Advanced Cybersecurity
Technology or proposed Advanced Cybersecurity Technology that is
generated by or provided to the Commission or another Federal
agency.\48\ In accordance with FPA section 219A(g), Advanced
Cybersecurity Technology Information is considered to be Critical
Electric Infrastructure Information as that term is defined in FPA
section 215A(a)(3) and Sec.  388.113(c)(1) of the Commission's
regulations.\49\ We also define CEII in new subpart K as having the
same meaning as that term is defined in Sec.  388.113 of the
Commission's regulations. In addition, we define Electric Reliability
Organization and Reliability Standard as having the same meanings as
those terms are defined in Sec.  39.1 of the Commission's
regulations.\50\
---------------------------------------------------------------------------

    \46\ IIJA, Public Law 117-58, section 40123, 135 Stat. 429, 951
(to be codified at 16 U.S.C. 824s-1(a)(1), (2)).
    \47\ Id. (to be codified at 16 U.S.C. 824s-1(a)(1)).
    \48\ Id. (to be codified at 16 U.S.C. 824s-1(a)(2)).
    \49\ 16 U.S.C. 824o-1(a)(3); 18 CFR 388.113(c)(1).
    \50\ 18 CFR 39.1.
---------------------------------------------------------------------------

3. Cybersecurity Investment Eligibility Criteria
a. NOPR Proposal
    28. In the NOPR, the Commission proposed that a cybersecurity
investment must satisfy two eligibility criteria to be considered for a
cybersecurity incentive.\51\ First, the cybersecurity investment would
need to materially improve cybersecurity through either an investment
in Advanced Cybersecurity Technology or participation in a
cybersecurity threat information sharing program. Second, the
cybersecurity investment could not already be mandated by CIP
Reliability Standards, or otherwise mandated by local, State, or
Federal law. Additionally, the Commission sought comment on whether,
and if so how, the Commission should evaluate and ensure that the
benefits of the cybersecurity investment exceed the combined costs of
the cybersecurity investment and incentive, to ensure that the proposed
rates are just and reasonable. The Commission also sought comment on
whether these would be the appropriate criteria and whether there are
additional criteria or limitations that the Commission should consider
(e.g., whether the Commission should consider an obligation imposed by
a State commission as a condition for a merger to be ineligible for an
incentive).
---------------------------------------------------------------------------

    \51\ NOPR, 180 FERC ] 61,189 at P 20.
---------------------------------------------------------------------------

    29. The Commission proposed that, in determining which
cybersecurity investments will materially improve a utility's security
posture, the Commission will consider the following sources: (1)
security controls enumerated in the NIST Special Publication (SP) 800-
53 ``Security and Privacy Controls for Information Systems and
Organizations'' catalog; \52\ (2) security controls satisfying an
objective found in the NIST Cybersecurity Framework; \53\ (3) a
specific recommendation from the Department of Homeland Security's
(DHS) Cybersecurity and Infrastructure Security Agency (CISA) or from
the Department of Energy (DOE); \54\ (4) a specific recommendation from
the CISA Shields Up Campaign; \55\ (5) participation in the
Cybersecurity Risk Information Sharing Program (CRISP) or similar
cybersecurity threat information sharing program; and/or (6) the
Cybersecurity Capability Maturity Model (C2M2) Domains \56\ at the
highest Maturity Indicator Level.\57\ The Commission proposed that
using these sources from other agencies responsible for addressing
sophisticated and rapidly evolving cyber threats as qualifiers for the
consideration of incentives would allow the Commission to benefit from
the expertise of other Federal agencies and help ensure that the
cybersecurity investments will be targeted and effective.
---------------------------------------------------------------------------

    \52\ NIST, Special Publication 800-53, Revision 5, Security and
Privacy Controls for Information Systems and Organizations, (Dec.
12, 2020), https://www.nist.gov/privacy-framework/nist-privacy-framework-and-cybersecurity-framework-nist-special-publication-800-53.
    \53\ See NIST, Cybersecurity Framework, https://www.nist.gov/cyberframework.
    \54\ See, e.g., CISA, National Cyber Awareness System Alerts,
https://www.cisa.gov/uscert/ncas/alerts.
    \55\ See CISA, Shields Up, https://www.cisa.gov/shields-up.
    \56\ See DOE, Cybersecurity Capability Maturity Model, https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2.
    \57\ NOPR, 180 FERC ] 61,189 at P 21.
---------------------------------------------------------------------------

b. Comments
    30. Microsoft Corporation (Microsoft) and the Michigan Public
Service Commission (Michigan Commission) support the proposed
eligibility criteria.\58\ The Office of the Ohio Consumers' Counsel
(Ohio Consumers' Counsel) also supports the proposed eligibility
criteria and recommends that the Commission require utilities to
demonstrate that their eligible expenditures provide quantifiable,
incremental benefits to rate payers that will exceed expenditure
cost.\59\
---------------------------------------------------------------------------

    \58\ Microsoft Initial Comments at 1; Michigan Commission
Initial Comments at 5-6.
    \59\ Ohio Consumers' Counsel Initial Comments at 4-5.
---------------------------------------------------------------------------

    31. Alliant Energy Corporate Services, Inc. (Alliant), the
Interstate Natural Gas Association of America (INGAA), the National
Rural Electric Cooperative (NRECA), and APPA support the proposed
eligibility criterion that a utility must show that a cybersecurity
investment materially improves its cybersecurity posture for its
investment to be eligible for an incentive.\60\ While NRECA supports
the proposed eligibility criterion, it is concerned that ``materially
improves cybersecurity''

may be too subjective to ensure that cybersecurity investments provide
adequate benefits to customers.\61\ NRECA recommends that the
Commission specify additional criteria or establish a minimum level of
benefit or value a cybersecurity investment would provide to be
eligible.\62\
---------------------------------------------------------------------------

    \60\ Alliant Initial Comments at 3-4; INGAA Initial Comments at
3; NRECA Initial Comments at 4-5; APPA Initial Comments at 3.
    \61\ NRECA Initial Comments at 4-5.
    \62\ Id. at 5.
---------------------------------------------------------------------------

    32. The Public Utilities Commission of Ohio's Office of the Federal
Energy Advocate (Ohio FEA) and Edison Electric Institute (EEI) do not
support the proposed eligibility criterion that a cybersecurity
investment must materially improve cybersecurity.\63\ Ohio FEA asserts
that the term ``materially improves'' may be ambiguous and suggests
that the Commission should provide additional detail regarding this
criterion in order to achieve its objective and streamline review of
cybersecurity incentives.\64\ EEI argues that applying a ``materially
improve'' test will lead to subjective and inconsistent results because
it is unclear what additional insights the Commission would reference
beyond the six sources from other agencies to satisfy the
criterion.\65\ EEI argues that the materiality test is not part of the
statutory language and will not necessarily improve the cybersecurity
posture of the filing utility.\66\ EEI recommends that, instead, the
Commission give utilities the flexibility to propose other sources than
the six listed in the NOPR and provide context for why a cybersecurity
investment supports a targeted level of cyber maturity within a broader
cybersecurity risk management and control framework.\67\
---------------------------------------------------------------------------

    \63\ EEI Initial Comments at 8; Ohio FEA Initial Comments at 5-
6.
    \64\ Ohio FEA Initial Comments at 5-6.
    \65\ EEI Initial Comments at 8.
    \66\ Id. at 8.
    \67\ Id. at 8.
---------------------------------------------------------------------------

    33. Ohio FEA supports the Commission referencing other Federal
agencies and activities to determine whether a cybersecurity investment
materially improves cybersecurity but asserts that the final
determination should be based on the specific circumstances of the
filing utility.\68\ INGAA recommends that the Federal Bureau of
Investigation (FBI) and the National Security Agency (NSA) be added to
the sources used to inform the Commission's determination of whether a
particular cybersecurity investment satisfies the first eligibility
criterion.\69\ DOE states that, while the six sources listed in the
NOPR are beneficial and valuable, they are not a comprehensive list of
ways that cybersecurity can be measured.\70\ SecurityScorecard
recommends that international standards such as ISO/IEC 27000 and
Information Systems Audit and Control Association's Control Objectives
for Information and Related Technologies also be considered when
assessing the materiality criteria.\71\
---------------------------------------------------------------------------

    \68\ Ohio FEA Initial Comments at 5-6.
    \69\ INGAA Initial Comments at 3.
    \70\ DOE Reply Comments at 6.
    \71\ SecurityScorecard Initial Comments at 4.
---------------------------------------------------------------------------

    34. DOE and EEI recommend that the Commission adjust the
eligibility criteria referencing the C2M2 Domains from the highest
Maturity Indicator Level to lower, incremental levels.\72\ DOE and EEI
argue that investments made to reach lower, incremental maturity levels
would be more valuable than overinvestment in unnecessary controls to
reach the highest Maturity Indicator Level.\73\
---------------------------------------------------------------------------

    \72\ DOE Reply Comments at 8-9; EEI Initial Comments at 8-9.
    \73\ DOE Reply Comments at 8; EEI Initial Comments at 8.
---------------------------------------------------------------------------

    35. Most commenters support the idea that expenditures already
mandated by local, State, or Federal law or an enforceable CIP
Reliability Standard should not be eligible for an incentive. EEI,
NRECA, and INGAA support this eligibility criterion as proposed in the
NOPR. Other commenters argue that the proposed criterion should be
expanded to include other types of legally binding agreements or
Reliability Standards.\74\ TAPS, APPA, Ohio FEA, California Parties,
and the Maryland Public Service Commission and Pennsylvania Public
Utility Commission (Maryland and Pennsylvania Commissions) argue that
investments made to satisfy any type of legal obligation should be
ineligible for an incentive, including, for example, remedial measures
as a settlement of NERC compliance violations, a condition of a State
or Federal license, a condition of a merger proceeding, and an
obligation under a cybersecurity insurance policy.\75\ APPA further
recommends that the Commission clarify whether investments are
ineligible if mandated by only CIP Reliability Standards or also by any
other mandatory Reliability Standard.\76\ In addition to an expanded
definition of ``mandated,'' TAPS recommends that the Commission require
a filing utility to attest that a cybersecurity investment for which it
seeks incentives is not being made to satisfy any legal obligation.\77\
---------------------------------------------------------------------------

    \74\ TAPS Initial Comments at 9-12; APPA Initial Comments at 13;
Ohio FEA Initial Comments at 6; California Parties Initial Comments
at 20; Maryland and Pennsylvania Commissions Initial Comments at 8.
    \75\ TAPS Initial Comments at 12.
    \76\ APPA Initial Comments at 13.
    \77\ TAPS Initial Comments at 12.
---------------------------------------------------------------------------

    36. The North American Electric Reliability Corporation and the six
Regional Entities \78\ (NERC) states that any voluntary incentives
should build upon and complement existing cybersecurity CIP Reliability
Standards.\79\ NERC recommends that the Commission consider the
relationship between voluntary cybersecurity investments and mandatory
CIP Reliability Standards and cautions that it may be a challenge for
the Commission to determine whether a particular investment is mandated
by the CIP Reliability Standards.\80\ NERC explains that, because the
CIP Reliability Standards are outcome oriented and do not prescribe
specific technologies, a utility may file for an incentive that, while
not mandated, is being used to comply with mandatory CIP Reliability
Standards.\81\ TAPS similarly states that the Commission should take a
nuanced approach to assess whether a technology exceeds the CIP
Reliability Standards when a technology has been used to comply with,
but is not specifically mandated by, a CIP Reliability Standard.\82\
NRECA urges the Commission to consider whether it will grant incentives
for cybersecurity expenditures that enhance the cybersecurity of low
impact BES Cyber Systems or only medium or high impact BES Cyber
Systems.\83\
---------------------------------------------------------------------------

    \78\ The six Regional Entities include the following: Midwest
Reliability Organization, Northeast Power Coordinating Council,
Inc., ReliabilityFirst Corporation, SERC Reliability Corporation,
Texas Reliability Entity, Inc., and Western Electricity Coordinating
Council.
    \79\ NERC Initial Comments at 3.
    \80\ Id. at 4.
    \81\ Id. at 4-5.
    \82\ TAPS Initial Comments at 12.
    \83\ NRECA Initial Comments at 5; see NERC Glossary defining BES
Cyber Systems.
---------------------------------------------------------------------------

    37. California Parties support the addition of an eligibility
criterion for information-sharing programs that the incentives be
conditioned on utilities participating in all applicable regional and
State cybersecurity initiatives.\84\ DOE recommends that the Commission
establish attributes that the Commission will consider when determining
the eligibility of information-sharing programs for incentives.\85\
---------------------------------------------------------------------------

    \84\ California Parties Initial Comments at 5.
    \85\ DOE Reply Comments at 10.
---------------------------------------------------------------------------

c. Commission Determination
    38. We adopt and modify the NOPR proposal by adding Sec.  35.48(d)
to the Commission's regulations to permit a utility to receive
incentive-based rate

treatment for a cybersecurity investment. We establish two eligibility
criteria that require that each cybersecurity investment: (1)
materially improves cybersecurity through either Advanced Cybersecurity
Technology or participation in a cybersecurity threat information
sharing program; and (2) is not already mandated by the Reliability
Standards, or otherwise mandated by local, State, or Federal law,
decision, or directive; otherwise legally mandated; or an action taken
in response to a Federal or State agency merger condition, consent
decree from Federal or State agency, or settlement agreement that
resolves a dispute between a utility and a public or private party.\86\
---------------------------------------------------------------------------

    \86\ As the dissent points out, FPA section 219A(c) directs the
Commission to establish rate incentives for participation by public
utilities in cybersecurity threat information sharing programs and
investments by public utilities in Advanced Cybersecurity
Technology, which it defines as any technology, operational
capability, or service, including computer hardware, software, or a
related asset, that enhances the security posture of public
utilities through improvements in the ability to protect against,
detect, respond to, or recover from a cyber security threat. Public
Law 117-58, section 40123(a), 135 Stat. 429, 951 (codified 16 U.S.C.
824s-1(c)). FPA section 219A also specifies that such rate
treatments exist for the purpose of benefitting consumers and
requires that the Commission ensure that resulting rates be just and
reasonable. See Public Law 117-58, section 40123(a), 135 Stat. 429,
951 (codified 16 U.S.C. 824s-1(a) & (c)). The materially improves
incentive eligibility criterion seeks to balance these statutory
requirements. Solely focusing on the term enhance may result in the
Commission granting incentives that do not meet these other
statutory requirements mentioned above. It is thus reasonable for
the Commission to exercise its judgement via the materially improves
eligibility criterion to evaluate incentives requests.
---------------------------------------------------------------------------

    39. In the NOPR, the Commission identified several sources that the
Commission would consider as part of its evaluation of whether a
cybersecurity investment would materially improve a utility's security
posture, thereby providing quantifiable cybersecurity benefits.\87\
Based on the comments received, we modify the NOPR proposal.
---------------------------------------------------------------------------

    \87\ In section III.B., we discuss different methods that
utilities could use to show how their cybersecurity investments
satisfy the eligibility criteria.
---------------------------------------------------------------------------

    40. As recommended by INGAA, we find that the Commission should
also consider specific recommendations from the FBI and NSA. Therefore,
we find that, in determining which cybersecurity investments will
materially improve a utility's security posture, the Commission will
consider the following sources: (1) security controls enumerated in the
NIST SP 800-53 ``Security and Privacy Controls for Information Systems
and Organizations'' catalog; \88\ (2) security controls satisfying an
objective found in the NIST Cybersecurity Framework \89\ technical
subcategory; (3) a specific cybersecurity recommendation from a
relevant Federal authority, such as DHS's CISA, the FBI, NSA, or DOE;
\90\ (4) participation in a relevant cybersecurity threat information
sharing program; and/or (5) achieving and sustaining one or more of the
C2M2 Domains at the highest Maturity Indicator Level.\91\ Considering
these sources as part of a Commission determination of whether a
particular cybersecurity investment would materially improve
cybersecurity will allow the Commission to approve objective, targeted,
and effective cybersecurity investments for incentive treatment.\92\
---------------------------------------------------------------------------

    \88\ NIST, Special Publication 800-53, Revision 5, Security and
Privacy Controls for Information Systems and Organizations, (Dec.
12, 2020), https://www.nist.gov/privacy-framework/nist-privacy-framework-and-cybersecurity-framework-nist-special-publication-800-53.
    \89\ See NIST, Cybersecurity Framework, https://www.nist.gov/cyberframework.
    \90\ See, e.g., CISA, National Cyber Awareness System Alerts,
https://www.cisa.gov/uscert/ncas/alerts.
    \91\ See DOE, Cybersecurity Capability Maturity Model, https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2.
    \92\ As we discuss in section III.B.1., when considering whether
to add a cybersecurity investment to the PQ List, the Commission
will determine whether the cybersecurity investment would materially
improve cybersecurity for all utilities. As we discuss in section
III.B.2., when evaluating a utility case-by-case application for
incentive-based rate treatment for a particular cybersecurity
investment, the Commission will determine whether the cybersecurity
investment would materially improve cybersecurity for the utility
requesting the incentive-based rate treatment.
---------------------------------------------------------------------------

    41. In addition, we agree with DOE's and Ohio FEA's recommendation
that the Commission expand the list of potential eligible cybersecurity
threat information sharing programs beyond CRISP. We clarify that a
utility may seek an incentive for participation in other cybersecurity
threat information sharing programs and the Commission will consider
whether such cybersecurity threat information sharing programs would
qualify for incentive treatment. We will not, as EEI suggests, consider
recommendations other than the five sources described above.
Considering other sources would increase subjectivity and
unpredictability of incentive-based rate treatment of cybersecurity
investments.
    42. We agree with DOE's and California Parties' recommendation that
the Commission should establish eligibility criteria or attributes in
evaluating cybersecurity threat information-sharing programs. The
Commission will evaluate any proposed relevant cybersecurity threat
information-sharing program to determine whether the program: (1) is
sponsored by the Federal or State government; (2) provides two-way
communications from and to electric industry and government entities;
and (3) delivers relevant and actionable cybersecurity information to
program participants from the United States electricity industry.
    43. We decline to adopt SecurityScorecard's recommendation that the
Commission consider international standards, such as ISO/IEC 27000,
when assessing the materiality criteria. Like NIST SP 800-53, ISO/IEC
27000 provides a catalog of information and cyber-related security
controls. While there are some differences in focus between the two
standards, for the context of determining how to successfully
categorize a cybersecurity investment used to improve the security
posture of a utility, both standards perform similar functions.
Therefore, we believe that considering such international standards in
assessing materiality would be duplicative and unnecessary and we will
not adopt this recommendation. Instead, we will use NIST SP 800-53 as
the foundation of security controls to evaluate whether a cybersecurity
investment materially improves the cybersecurity of a utility because
NIST SP 800-53 was developed by a Federal agency and is publicly
accessible without additional cost.
    44. We also decline to adopt DOE and EEI's recommendation that the
Commission provide incentives for any incremental steps taken by
utilities in connection with C2M2 and not just for achieving the
highest Maturity Indicator Level. The C2M2 model contains descriptive
cybersecurity measures at a high level rather than prescriptive
requirements. Therefore, it would be difficult for the Commission to
determine that compliance with incremental steps necessarily materially
improves cybersecurity. For these reasons, we are requiring a utility
to demonstrate that its proposed cybersecurity investments will cause
the utility to achieve Maturity Indicator Level 3 of the C2M2 Domains
rather than the incremental steps of the lower Maturity Indicator
Levels in order to receive an incentive for its cybersecurity
investments.
    45. TAPS, APPA, Ohio FEA, California Parties, and the Maryland and
Pennsylvania Commissions request that the Commission ensure that
investments made to satisfy any type of legal obligation be ineligible
for an incentive. The Maryland and Pennsylvania

Commissions comment that utilities should not receive incentives for
implementing cybersecurity measures that are already made mandatory by
existing and future obligations.\93\ APPA comments that the Commission
should broaden the second eligibility criterion to clarify that
incentives would not be available for cybersecurity investments for
mandatory Reliability Standards and that the Commission should replace
the reference to the CIP Reliability Standards with Reliability
Standards.\94\ We agree with both suggestions. Accordingly, we are
expanding the second eligibility criterion to emphasize the requirement
that the utility must undertake the specific cybersecurity investment
voluntarily in order to receive a cybersecurity incentive pursuant to
our regulations. Our revised Sec.  35.48(d)(2) provides that a
cybersecurity investment is only eligible for an incentive if it is not
already mandated by the Reliability Standards as maintained by the
Electric Reliability Organization, or otherwise mandated by local,
State, or Federal law, decision, or directive; otherwise legally
mandated; or an action taken in response to a Federal or State agency
merger condition, consent decree from Federal or State agency, or
settlement agreement that resolves a dispute between a utility and a
public or private party.\95\
---------------------------------------------------------------------------

    \93\ Maryland and Pennsylvania Commissions Initial Comments at
8.
    \94\ APPA Initial Comments at 5.
    \95\ A mandate must either be for a utility to achieve a
specific outcome or to require a utility to take a prescribed
action. General mandates to improve a utility's cybersecurity may
still make specific cybersecurity investments voluntary for purposes
of the Commission's evaluation of the eligibility criteria.
---------------------------------------------------------------------------

    46. Additionally, we recognize the concerns raised by NERC and TAPS
about the difficulty in determining whether a particular cybersecurity
investment is mandatory. Accordingly, as discussed in greater detail in
section III.D.3., we are adopting TAPS's suggestion that, in order to
demonstrate that the specific cybersecurity investment for which the
utility is seeking an incentive is voluntary, the applicant must
include an attestation in its filing so stating.\96\
---------------------------------------------------------------------------

    \96\ The attestation must be made by a senior person within the
utility that the utility has authorized to act on behalf of the
utility. One example of a senior person could be the CIP Senior
Manager as NERC defines that term. NERC Glossary at 10 (defining CIP
Senior Manager to mean ``A single senior management official with
overall authority and responsibility for leading and managing
implementation of and continuing adherence to the requirements
within the NERC CIP Standards, CIP-002 through CIP-011.'').
---------------------------------------------------------------------------

    47. TAPS raises issues about technologies that both meet and exceed
the Reliability Standards. We recognize that there could be a single
Advanced Cybersecurity Technology that provides multiple security
controls that allow the utility to meet and potentially exceed
compliance with a Reliability Standard. In that instance, where the
utility makes a single cybersecurity investment for security controls
to comply with a Reliability Standard, that investment will not be
incentive-eligible. However, there may be instances where a utility
invests in a single Advanced Cybersecurity Technology that while
complying with a Reliability Standard also provides enhanced
cybersecurity controls that go beyond compliance with a Requirement in
the Reliability Standard. In those instances, only the incremental
investment to exceed the Requirement of the Reliability Standard would
be eligible for an incentive.
    48. In response to NRECA's concerns regarding the reliability and
security of low impact BES Cyber Systems, we are not requiring any
eligibility criteria other than the two discussed above. Therefore, low
impact BES Cyber Systems are not excluded from eligibility for
incentive-based rate treatment for cybersecurity investments.
    49. We disagree with EEI's conclusion that we should omit
``materially improve'' as the standard for the first eligibility
criterion due to its absence from the statutory language and possible
subjectivity. FPA section 219A requires the Commission to offer
incentives for Advanced Cybersecurity Technology investments and
participation in information-sharing programs. It does not require that
the Commission provide incentives for all Advanced Cybersecurity
Investments or participation in any information-sharing program. FPA
section 219A also requires that the Commission ensure that rates are
just and reasonable and not unduly discriminatory or preferential.\97\
Without a materiality standard in the first criterion (or something
similar), any Advanced Cybersecurity Investment that is not mandatory
would be incentive-eligible, regardless of whether such investments
enhance a utility's security posture or result in just and reasonable
rates. Furthermore, use of such a standard is consistent with
Commission precedent. In Order No. 679, the Commission required
applicants for transmission incentives to show that requested
incentives are tailored to the risks and challenges of individual
projects, even though such a requirement is not included in the
statutory language of FPA section 219.\98\
---------------------------------------------------------------------------

    \97\ FPA section 219A(e)(1). FPA section 219A(e)(2) also
prohibits unjust and unreasonable double recovery for Advanced
Cybersecurity Technology. IIJA, Public Law 117-58, section 40123,
135 Stat. at 952 (to be codified at 16 U.S.C. 824s-1(e)(2)).
    \98\ See Promoting Transmission Investment Through Pricing
Reform, Order No. 679, 71 FR 43294 (July 31, 2006), 116 FERC ]
61,057, at P 26, order on reh'g, Order No. 679-A, 72 FR 1152 (Jan.
10, 2007), 117 FERC ] 61,345 (2006), order on reh'g, 119 FERC ]
61,062 (2007).
---------------------------------------------------------------------------

    50. We recognize that the materially improves criterion requires
use of Commission subject matter expertise and judgement. In exercising
its subject matter expertise and judgement, the Commission will take
into account the findings of other Federal agencies to inform its
decisions, as described in section III.B.2.c. Although the Commission
seeks to maximize predictability and transparency in its provision of
incentives, some degree of judgement is necessary given the many types
of cybersecurity threats and investments and their rapid evolution. It
is for this reason that we also decline NRECA's request that the
Commission provide additional criteria or a baseline level of benefit.
As discussed in section III.C.3., quantification of benefits may be
difficult for cybersecurity investments, such that a bright line
benefit requirement is inappropriate. In this final rule, we are
establishing eligibility criteria that balance the need to ensure that
incentives are targeted at the most beneficial investments with
recognizing that there are many potential cybersecurity investments
which could provide a wide variety of benefits. We find that overly
prescriptive eligibility criteria may unduly preclude incentive-based
rate treatment of beneficial cybersecurity investments.
    51. Although the Commission sought comment on whether, and if so
how, the Commission should evaluate and ensure that the benefits of the
cybersecurity investment exceed the combined costs of the cybersecurity
investment and the incentive, to ensure that the proposed rates are
just and reasonable, we will not at this time predicate incentive
eligibility on such a cost-benefit showing. As the Commission proposed
in the NOPR and we affirm here, the rates, including the costs of any
incentive, must remain within the zone of reasonableness. This is
necessary to ensure that the rates that include incentives for
cybersecurity investments are just and reasonable and not unduly
discriminatory or preferential.
    52. Ohio Consumers' Counsel argues that there must be quantifiable,
incremental benefits that can be measured in cost-benefit savings to
consumers. Nevertheless, we find that quantification of the costs and
benefits for each cybersecurity investment is

neither required nor practical. Such a cost-benefit analysis is
particularly inapt for cybersecurity where benefits are even harder to
identify and quantify than are economic and reliability benefits for
transmission investments. The courts have long recognized that a
primary purpose of the FPA, and its counterpart the Natural Gas Act
(NGA), is to encourage the orderly development of plentiful supplies of
electricity and natural gas at reasonable prices.\99\ To carry out this
purpose, the Commission may consider non-cost factors as well as cost
factors.\100\ Moreover, Congress' enactment of section 219A reflects
its determination that incentives generally can spur cybersecurity
investments and their associated consumer benefits.
---------------------------------------------------------------------------

    \99\ Order No. 679, 116 FERC ] 61,057 at P 65 (citing Pub. Util.
Comm'n of the State of Cal. v. FERC, 367 F.3d 925, 929 (D.C. Cir.
2004) (citing NAACP v. FPC, 425 U.S. 662, 670 (1976))).
    \100\ Id. (citing Permian Basin Area Rate Cases, 390 U.S. 747,
791, 815 (1968); Me. Pub. Utils. Comm'n v. FERC, 454 F.3d 278, 288
(DC Cir. 2006)).
---------------------------------------------------------------------------

    53. As the Commission proposed in the NOPR, we find that all
cybersecurity investments must satisfy both of the eligibility criteria
in order to be eligible for incentive treatment. In addition, we now
clarify that a utility may not request an incentive for a cybersecurity
investment that the utility has already been incurring for more than
three months prior to the filing of the incentive application, as
discussed in section III.C.2 of this final rule, unless that
cybersecurity investment is for participation in an incentive-eligible
cybersecurity threat information sharing program.

B. Cybersecurity Investment Incentive Requests

    54. In order to maximize predictability and transparency in our
provision of incentives, we provide below a framework for evaluating
whether certain cybersecurity investments, including expenses and
capitalized costs, are eligible for a cybersecurity incentive. First,
as the Commission proposed in the NOPR, we include a list of pre-
qualified investments, the PQ List, to identify certain cybersecurity
investments that the Commission finds merit the rebuttable presumption
of eligibility for all utilities and are therefore eligible for
incentive-based rate treatment. We also discuss the procedures that we
will use to update the PQ List. Second, we adopt the cybersecurity
investments proposed in the NOPR for inclusion on the initial PQ List.
Third, we describe how the Commission will evaluate whether a utility's
cybersecurity investments that are not included on the PQ List may be
eligible for incentive-based rate treatment. Finally, we discuss how a
utility can seek incentive-based rate treatment for new cybersecurity
investments made to comply with a Reliability Standard during the
period after the Commission approves a new or modified cybersecurity
Reliability Standard but before that new or modified cybersecurity
Reliability Standard becomes mandatory and enforceable.
1. PQ List Approach
a. Structure of the PQ List
i. NOPR Proposal
    55. In the NOPR, the Commission proposed to create a PQ List that
would identify cybersecurity investments that the Commission determined
would satisfy the eligibility criteria.\101\ The Commission proposed
that any cybersecurity investment that the Commission includes on the
PQ List would be entitled to a rebuttable presumption of eligibility
for an incentive.\102\ However, an applicant would still need to
demonstrate, and the Commission would need to find, that the proposed
rate, inclusive of the cybersecurity incentive, is just and reasonable.
The Commission proposed to provide an opportunity for protestors to
rebut this presumption by demonstrating that the cybersecurity
investment did not meet one or more of the eligibility criteria (e.g.,
that, given the unique circumstances of the utility, the expenditure
for which the utility seeks an incentive would not materially improve
cybersecurity or is otherwise mandatory for that utility) or the
Commission could make this finding based on other evidence.
---------------------------------------------------------------------------

    \101\ NOPR, 180 FERC ] 61,189 at P 25.
    \102\ Id. P 26.
---------------------------------------------------------------------------

    56. The Commission explained that the PQ List approach would
provide efficiency and transparency benefits.\103\ The utility-specific
incentive filings under the PQ List approach could be substantially
streamlined compared to a case-by-case approach because the Commission
would have pre-reviewed the cybersecurity investments included on the
PQ List for eligibility for incentives.
---------------------------------------------------------------------------

    \103\ Id. P 27.
---------------------------------------------------------------------------

    57. In the NOPR, the Commission noted the rapidly evolving nature
of cybersecurity threats and solutions and that it expected to
regularly evaluate the PQ List and update it as necessary.\104\ When
updating the PQ List, the Commission could add, modify, or remove
cybersecurity investments to/from the PQ List. The Commission proposed
that it would update the PQ List via a rulemaking, whether sua sponte
or in response to a petition.
---------------------------------------------------------------------------

    \104\ Id. P 31.
---------------------------------------------------------------------------

ii. Comments
    58. INGAA, Microsoft, TAPS, the Michigan Commission, Ohio
Consumers' Counsel, ITC Companies, APPA, Anterix, Inc. (Anterix), OT
Coalition, Avangrid, Inc. (Avangrid), MISO Transmission Owners, EPSA,
and EEI support the PQ List approach.\105\ OT Coalition, Avangrid, MISO
Transmission Owners, EPSA, and EEI further urge the Commission to
consider using both the PQ List and case-by-case approaches.\106\ ITC
Companies agree with the Commission that the PQ List approach will
decrease the filing and review burden on utilities and the Commission
\107\ while INGAA and Microsoft agree that the PQ List approach will
provide transparency for utilities as to what expenditures will be
eligible for incentives.\108\ Microsoft and Anterix caveat their
support of the PQ List approach by suggesting other items for inclusion
on the PQ List, such as security incident and event monitoring, user
and entity behavior analysis,\109\ and private LTE wireless broadband
communication systems.\110\ TAPS, Michigan Commission, and Ohio
Consumers' Counsel recommend that the PQ List be updated
regularly,\111\ and APPA underscores the need for stakeholders to have
the opportunity to rebut the presumption of eligibility.\112\
---------------------------------------------------------------------------

    \105\ INGAA Initial Comments at 4; Microsoft Initial Comments at
2; TAPS Initial Comments at 4; Michigan Commission Initial Comments
at 6; Ohio Consumers' Counsel Initial Comments at 8-9; ITC Companies
Initial Comments at 4-5; APPA Initial Comments at 17; Anterix
Initial Comments at 5; OT Coalition Initial Comments at 2; Avangrid
Initial Comments at 5; MISO Transmission Owners Initial Comments at
6-7; EPSA Initial Comments at 5; EEI Initial Comments at 5.
    \106\ OT Coalition Initial Comments at 2; Avangrid Initial
Comments at 5; MISO Transmission Owners Initial Comments at 6-7;
EPSA Initial Comments at 5; EEI Comments at 5.
    \107\ ITC Companies Initial Comments at 4-5.
    \108\ INGAA Initial Comments at 4; Microsoft Initial Comments at
2.
    \109\ Microsoft Initial Comments at 1-2.
    \110\ Anterix Initial Comments at 5.
    \111\ TAPS Initial Comments at 6; Michigan Commission Initial
Comments at 6; Ohio Consumers' Counsel Initial Comments at 8-9.
    \112\ APPA Initial Comments at 5.
---------------------------------------------------------------------------

    59. In contrast, Alliant, the Maryland and Pennsylvania
Commissions, and DOE assert that that the PQ List approach with its
rebuttable presumption of eligibility will lessen innovation by
encouraging utilities to pursue the same types of cybersecurity
investments (i.e., those on the PQ List), regardless of the utility's
individual

needs and risks.\113\ California Parties, while not necessarily opposed
to the concept of a PQ List approach, strongly oppose giving filing
utilities a rebuttable presumption of eligibility for expenditures on
the PQ List.\114\ They argue that the burden on a party seeking to
rebut the presumption of eligibility is too great.\115\
---------------------------------------------------------------------------

    \113\ Alliant Initial Comments at 4-5; Maryland and Pennsylvania
Commissions Initial Comments at 6.
    \114\ California Parties Initial Comments at 28-29.
    \115\ Id.; California Parties Reply Comments at 11-12.
---------------------------------------------------------------------------

    60. Many commenters raise concerns that finding a balance between
transparency and security will prove challenging for the Commission.
NRECA cautions that a publicly accessible PQ List will alert
adversaries to the cybersecurity activities of utilities and create a
security risk.\116\ Alliant recommends that, if the Commission decides
to proceed with the PQ List approach, it defer to NERC for
identification of technologies and designate the PQ List as CEII to
protect it from public access.\117\ On the other hand, California
Parties and the Maryland and Pennsylvania Commissions underscore the
need for public transparency and access to allow stakeholders to rebut
the presumption of eligibility and utilities to know what types of
expenditures are eligible.\118\
---------------------------------------------------------------------------

    \116\ NRECA Initial Comments at 7-8.
    \117\ Alliant Initial Comments at 4-5.
    \118\ California Parties Initial Comments at 28-29; Maryland and
Pennsylvania Commissions Initial Comments at 5-6.
---------------------------------------------------------------------------

    61. Some commenters describe the challenges that maintaining an
updated PQ List will present for the Commission. Ohio FEA and the
Maryland and Pennsylvania Commissions express concern that the
Commission may be unable to maintain a current PQ List, due to the
lengthy regulatory process required,\119\ potentially leading to
overinvestment in outdated measures and underinvestment in cutting edge
technologies.\120\ Most commenters support frequent and regular review
and updates to the PQ List.\121\ EEI recommends that the Commission
commit to reviewing and updating the PQ List on a regular cadence no
less than annually, while Anterix, Avangrid, TAPS, and Ohio Consumers'
Counsel suggest regular and expeditious updates.\122\ TAPS and Ohio
Consumers' Counsel recommend that, when the Commission initiates a
rulemaking to modify the PQ List, it should assess whether existing
expenditures still meet the eligibility criteria in addition to
assessing new additions.\123\
---------------------------------------------------------------------------

    \119\ Ohio FEA Initial Comments at 14; Maryland and Pennsylvania
Commissions Initial Comments at 5.
    \120\ Maryland and Pennsylvania Commissions Initial Comments at
5.
    \121\ Avangrid Initial Comments at 5; EEI Initial Comments at 6-
7; TAPS Initial Comments at 5; Ohio Consumers' Counsel Initial
Comments at 8; Anterix Reply Comments at 4.
    \122\ EEI Initial Comments at 6-7; Anterix Reply Comments at 4.;
Avangrid Initial Comments at 5; TAPS Initial Comments at 5; Ohio
Consumers' Counsel Initial Comments at 7.
    \123\ TAPS Initial Comments at 5; Ohio Consumers' Counsel
Initial Comments at 8.
---------------------------------------------------------------------------

    62. California Parties and NRECA emphasize that modifications to
the PQ List should only be made via a full rulemaking process where
stakeholders and customers have the opportunity to comment.\124\
California Parties further argue that the Commission should not expand
the initial PQ List in its final rule without a full notice-and-comment
period for the suggested additions.\125\ TAPS highlights that the
rulemaking process will improve regulatory certainty for utilities and
customers and facilitate participation and input on whether proposed
expenditures meet the eligibility criteria.\126\
---------------------------------------------------------------------------

    \124\ NRECA Initial Comments at 8-9; California Parties Initial
Comments at 33-34.
    \125\ California Parties Initial Comments at 11-12.
    \126\ TAPS Initial Comments at 5.
---------------------------------------------------------------------------

    63. Indicated PJM Transmission Owners \127\ and Anterix recommend
that the Commission hold a technical conference to inform its decision
making on reviewing and updating the eligible expenditures on the PQ
List.\128\
---------------------------------------------------------------------------

    \127\ Indicated PJM Transmission Owners consist of: American
Electric Power Service Corporation on behalf of its affiliates,
Appalachian Power Company, Indiana Michigan Power Company, Kentucky
Power Company, Kingsport Power Company, Ohio Power Company, Wheeling
Power Company, AEP Appalachian Transmission Company, Inc., AEP
Indiana Michigan Transmission Company, Inc., AEP Kentucky
Transmission Company, Inc., AEP Ohio Transmission Company, Inc., and
AEP West Virginia Transmission Company, Inc.; Dayton Power and Light
Company d/b/a AES Ohio; Dominion Energy Services, Inc. on behalf of
Virginia Electric and Power Company d/b/a Dominion Energy Virginia;
Duke Energy Corporation on behalf of its affiliates Duke Energy
Ohio, Inc., Duke Energy Kentucky, Inc., and Duke Energy Business
Services LLC; Duquesne Light Company; East Kentucky Power
Cooperative; Exelon Corporation; FirstEnergy Service Company, on
behalf of its affiliates American Transmission Systems,
Incorporated, Jersey Central Power & Light Company, Mid-Monongahela
Power Company, Keystone Appalachian Transmission Company, and Trans-
Allegheny Interstate Line Company; PPL Electric Utilities
Corporation; Public Service Electric and Gas Company; Rockland
Electric Company; and UGI Utilities Inc.
    \128\ Indicated PJM Transmission Owners Initial Comments at 5;
Anterix Initial Comments at 12-13.
---------------------------------------------------------------------------

iii. Commission Determination
    64. We adopt and modify the NOPR's proposal to create a PQ List by
adding Sec.  35.48(e)(1) to the Commission's regulations, which
establishes the framework for a PQ List of cybersecurity investments
that the Commission finds materially improves cybersecurity. We find
that the cybersecurity investments on the PQ List would be entitled to
a presumption of satisfying the eligibility criteria. As proposed in
the NOPR, protestors may seek to rebut this presumption by
demonstrating that, given the unique circumstances of the utility, the
cybersecurity investment on the PQ List would not materially improve
cybersecurity of the utility. We note that the utility would still need
to demonstrate that it would make the cybersecurity investment
voluntarily. In addition, the Commission will not presume anything
about the resulting rates. Utilities seeking an incentive under the PQ
List must still show that the proposed rate, including the
cybersecurity incentive, is just and reasonable and not unduly
discriminatory or preferential.
    65. The PQ List approach is also in line with FPA section
219A(d)(2), which allows the Commission to reduce the cybersecurity
risks to the facilities of small or medium-sized public utilities with
limited cybersecurity resources.\129\ While all utilities would benefit
from the reduced filing obligations when requesting incentive treatment
for cybersecurity investments on the PQ List, we expect that this
approach would be particularly beneficial for small and medium-sized
utilities with limited cybersecurity resources.
---------------------------------------------------------------------------

    \129\ FPA section 219A(d)(2) provides that the Commission may
provide additional incentives beyond incentive-based rate treatment
in any case which the Commission determines that an investment in
Advanced Cybersecurity Technology or in information sharing program
costs will reduce cybersecurity risks to facilities of small or
medium-sized public utilities with limited cybersecurity resources,
as determined by the Commission. IIJA, Public Law 117-58, section
40123, 135 Stat. at 952 (to be codified at 16 U.S.C. 824s-1(d)(2)).
---------------------------------------------------------------------------

    66. We disagree with concerns that including cybersecurity
investments on the PQ List would lessen cybersecurity innovation or
alert adversaries of utility cybersecurity investment. Regarding
lessening innovation, as an initial matter, we note that utilities may
still seek to recover in their rates all prudently incurred
cybersecurity investments. Furthermore, as described in section
III.B.2, we are adding a case-by-case approach that may better incent
cybersecurity investments responding to rapidly evolving threats than
does the PQ List. Regarding concerns about alerting adversaries, we
find that such assertions are speculative and that describing and
providing incentives to broadly beneficial cybersecurity investments
will not unto itself

highlight either industry-wide or utility-specific vulnerabilities.
    67. We disagree with comments recommending that we designate the PQ
List as CEII. The PQ List does not meet the definition of CEII, because
the list is general in nature and does not reveal specific
vulnerabilities.\130\ As discussed in section III.D.3.c., requests for
incentive-based rate treatment for cybersecurity investments may
include requests for CEII treatment consistent with our
regulations.\131\ As we approve additional PQ List items, we expect
that any future PQ List item will not be more specific than what can be
found in the already publicly available materials, such as the NIST
publications and CIP Reliability Standards. We decline to adopt
Alliant's recommendation that the Commission defer to NERC to identify
eligible technologies for the PQ List. The Commission will evaluate
potential cybersecurity technologies from time to time, and determine,
based on the record evidence, whether it would be appropriate to add
the proposed cybersecurity investments in these technologies to the PQ
List.
---------------------------------------------------------------------------

    \130\ See 18 CFR 388.113(c).
    \131\ See 18 CFR 388.113.
---------------------------------------------------------------------------

    68. We disagree with comments that the PQ List approach places an
undue burden on parties seeking to rebut the presumption of
eligibility. We believe that the PQ List approach appropriately
balances the interests of the utilities and any potential protestors
seeking to rebut the presumption of eligibility. By starting with the
initial PQ List, we have identified specific cybersecurity investments
that we find will materially improve the cybersecurity of utilities
broadly, while enabling protestors to demonstrate that the eligibility
criteria are not met in a utility's particular circumstance.
    69. We acknowledge the concerns raised by commenters regarding the
time necessary for the Commission to modify the PQ List. Some
commenters request that the Commission commit to a regular update cycle
for the PQ List. In this final rule, the Commission modifies the
proposed regulation to allow the Commission to post the PQ List on its
website and to update it subject to a notice and comment period or in a
rulemaking. In addition, the case-by-case approach allows the
Commission to evaluate whether a utility's cybersecurity investment
would satisfy the eligibility criteria as to that utility. This means
that utilities would not have to wait for the Commission to update the
PQ List before seeking incentives for cybersecurity investments not yet
included on the PQ List. In response to Indicated PJM Transmission
Owners and Anterix's suggestion to have a technical conference when
considering updates to the PQ List, we note that the Commission will
consider such action when undertaking its periodic PQ List reviews.
b. Initial PQ Lis
i. NOPR Proposal
    70. The Commission proposed to include two eligible cybersecurity
investments on the initial PQ List: (1) expenditures associated with
participation in CRISP; \132\ and (2) expenditures associated with
internal network security monitoring within the utility's cyber
systems, which could include IT cyber systems and/or OT cyber systems,
and which could be associated with cyber systems that may or may not be
subject to the Reliability Standards.\133\ The Commission believed that
these cybersecurity investments would materially improve cybersecurity
\134\ and were not already mandated by the Reliability Standards \135\
or otherwise mandated by Federal law. The Commission proposed to
include CRISP, as its purpose is to facilitate the timely bi-
directional sharing of unclassified and classified threat information
and development of situational awareness tools that enhance the energy
sector's ability to identify, prioritize, and coordinate the protection
of critical infrastructure and key resources.\136\
---------------------------------------------------------------------------

    \132\ See DOE, Energy Sector Cybersecurity Preparedness, https://www.energy.gov/ceser/energy-sector-cybersecurity-preparedness.
    \133\ NOPR, 180 FERC ] 61,189 at P 28.
    \134\ E.g., both participation in CRISP and internal network
security monitoring would fall under recommendations in the NIST SP
800-53 ``Security and Privacy Controls for Information Systems and
Organizations'' catalog.
    \135\ The Commission noted in the NOPR that it had already
proposed to require NERC to develop and submit for Commission
approval a mandatory Reliability Standard regarding internal network
analysis and monitoring technologies for high and medium impact bulk
electric system cyber systems. See NOPR, 180 FERC ] 61,189 at P 28
n.26 (citing Internal Network Sec. Monitoring for High & Medium
Impact Bulk Elec. Sys. Cyber Syss., Notice of Proposed Rulemaking,
87 FR 4173 (Jan. 27, 2022), 178 FERC ] 61,038 (2022)). The
Commission has since issued a final rule directing NERC to develop
and submit for Commission approval a Reliability Standard that
addresses internal network security monitoring for high impact bulk
electric system cyber systems and medium impact bulk electric system
cyber systems with external routable connectivity. Internal Network
Sec. Monitoring for High & Medium Impact Bulk Elec. Sys. Cyber
Syss., Order No. 887, 88 FR 8354 (Feb. 9, 2023), 182 FERC ] 61,021
(2023).
    \136\ DOE, Energy Sector Cybersecurity Preparedness, https://www.energy.gov/ceser/energy-sector-cybersecurity-preparedness.
---------------------------------------------------------------------------

    71. The Commission also proposed to include internal network
security monitoring on the PQ List because internal network security
monitoring may better position a utility to detect malicious activity
that has circumvented perimeter controls.\137\ The Commission observed
that, while the currently effective Reliability Standards do not
require internal network security monitoring, NERC has recognized the
proliferation and usefulness of such technology.\138\ The Commission
also sought comments on whether to include any additional cybersecurity
investments on the initial PQ List.
---------------------------------------------------------------------------

    \137\ NOPR, 180 FERC ] 61,189 at P 29.
    \138\ Id. (citing NERC, ERO Enterprise CMEP Practice Guide:
Network Monitoring Sensors, Centralized Collectors, and Information
Sharing, 1 (June 4, 2021), https://www.nerc.com/pa/comp/guidance/CMEPPracticeGuidesDL/CMEP%20Practice%20Guide%20-%20Network%20Monitoring%20Sensors.pdf (explaining that NERC
developed the guide in response to a DOE initiative ``to advance
technologies and systems that will provide cyber visibility,
detection, and response capabilities for [industrial control
systems] of electric utilities.'').
---------------------------------------------------------------------------

ii. Comments
    72. NERC, DOE, and Microsoft support the inclusion of CRISP on the
PQ List.\139\ EEI and American Electric Power Service Corporation (AEP)
support incentives for both new and existing participants of
CRISP.\140\ EEI argues that, because participation in cybersecurity
threat information sharing programs is an ongoing action and CRISP
participants have to occasionally upgrade technology, existing
participants should be eligible to receive an incentive.\141\
---------------------------------------------------------------------------

    \139\ NERC Initial Comments at 3; DOE Reply Comments at 7;
Microsoft Initial Comments at 2.
    \140\ EEI Initial Comments at 11; EEI Reply Comments at 5. AEP
Initial Comments at 4.
    \141\ EEI Initial Comments at 11; EEI Reply Comments at 5.
---------------------------------------------------------------------------

    73. APPA and California Parties oppose the Commission providing
incentives for existing CRISP participants.\142\ APPA and California
Parties argue that an incentive must be an inducement for future action
and cannot provide an incentive for actions already taken, such as
recovery of an incentive for ongoing participation in CRISP if a
utility is already a participant.\143\ APPA further adds that CRISP
participants report high satisfaction with the program and thus do not
need an incentive to continue participation.\144\ The Maryland and
Pennsylvania Commissions and California Parties note that most major

investor-owned utilities are already part of CRISP, whether
individually or as members of a respective regional transmission
organization or independent system operator.\145\
---------------------------------------------------------------------------

    \142\ APPA Initial Comments at 5; California Parties Initial
Comments at 10; California Parties Reply Comments at 8-9.
    \143\ APPA Initial Comments at 12-13; California Parties Initial
Comments at 10; California Parties Reply Comments at 8-9.
    \144\ APPA Initial Comments at 13-14.
    \145\ Maryland and Pennsylvania Commissions Initial Comments at
9; California Parties Initial Comments at 7-8.
---------------------------------------------------------------------------

    74. EEI, UMass Lowell Applied Research Corporation (UMLARC), Ohio
FEA, and Microsoft recommend that the Commission consider for inclusion
on the PQ List additional eligible cybersecurity threat information
sharing programs.\146\ EEI recommends that the PQ List be expanded to
include other federally funded or supported cybersecurity threat
information sharing programs,\147\ while Ohio FEA suggests that the
National Cyber Security Division cyber-response programs under DHS
should be included in the PQ List.\148\ Microsoft recommends modifying
the proposed language to be solution-neutral and outcome-focused to
accommodate other timely bi-directional threat information-sharing
programs.\149\
---------------------------------------------------------------------------

    \146\ EEI Initial Comments at 6; UMLARC Initial Comments at 4;
Ohio FEA Initial Comments at 7-8.; Microsoft Initial Comments at 2.
    \147\ EEI Initial Comments at 6.
    \148\ Ohio FEA Initial Comments at 7-8.
    \149\ Microsoft Initial Comments at 2.
---------------------------------------------------------------------------

    75. Microsoft and EEI support the inclusion of internal network
security monitoring on the initial PQ List.\150\ EEI further recommends
that the Commission broaden the eligibility for incentives to
cybersecurity capabilities across protective and detective controls,
not only those limited to internal network security monitoring.\151\
Similarly, SecurityScorecard suggests that the Commission broaden its
focus from internal network security monitoring to continuous
monitoring so as to secure both the perimeter and internal
network.\152\ Microsoft supports eligible expenditures associated with
internal network security monitoring as cybersecurity best practices
consistent with a Zero Trust security model, including technologies
associated with asset discovery, inventory and management, network
monitoring, traffic classification, and behavior analytics within the
internal environment.\153\
---------------------------------------------------------------------------

    \150\ Id.; EEI Initial Comments at 5.
    \151\ EEI Initial Comments at 5.
    \152\ SecurityScorecard Initial Comments at 6.
    \153\ Microsoft Initial Comments at 2.
---------------------------------------------------------------------------

    76. While acknowledging the cybersecurity benefits of internal
network security monitoring, APPA and California Parties do not support
its inclusion on the PQ List.\154\ California Parties state that
utilities have sufficient financial incentives to allocate funding
towards internal network security monitoring through the Commission's
existing cost recovery mechanisms, and that mandatory CIP Reliability
Standards are better suited than incentives for facilitating widespread
adoption of internal network security monitoring.\155\ APPA argues that
internal network security monitoring is not a category of expenditures
that can be presumed to materially improve cybersecurity prior to
agreement on best practices.\156\ In their reply comments, California
Parties echo APPA's concerns and note the lack of consensus between
commenters as to what qualifies as internal network security
monitoring.\157\
---------------------------------------------------------------------------

    \154\ APPA Initial Comments at 18; California Parties Initial
Comments at 13-14.
    \155\ California Parties Initial Comments at 13-14.
    \156\ APPA Initial Comments at 18.
    \157\ California Parties Reply Comments at 10.
---------------------------------------------------------------------------

    77. NERC notes that the CIP Reliability Standards are technology-
neutral and do not prescribe specific technological methods, tools, or
approaches to reach compliance.\158\ NERC states that utilities and
other NERC-registered entities may already be using internal network
security monitoring in combination with other tools or processes to
comply with Reliability Standards and therefore cautions that it may be
difficult to determine whether a particular cybersecurity investment is
mandatory for purposes of analyzing the second eligibility criterion.
---------------------------------------------------------------------------

    \158\ NERC Initial Comments at 4-5.
---------------------------------------------------------------------------

    78. UMLARC argues that defense communities face particular
cybersecurity risks. UMLARC explains that certain defense communities
are implementing community cyber force pilot programs. UMLARC
recommends that the Commission place community cyber forces for
information-sharing programs on the PQ List, while noting that these
programs are still in pilot phases.\159\
---------------------------------------------------------------------------

    \159\ UMLARC Initial Comments at 4.
---------------------------------------------------------------------------

    79. NERC recommends that the Commission consider the deployment of
sensors as part of an operational technology visibility program,
administered by the Electricity Information Sharing and Analysis Center
(E-ISAC), for inclusion on the PQ List.\160\ Microsoft, MISO
Transmission Owners,\161\ and EEI support the inclusion of internal
network security monitoring on the PQ List but recommend that internal
network security monitoring expenditures be consistent with a Zero
Trust security model.\162\ EEI suggests that technology and processes
to implement, manage, and monitor user and endpoint behavioral analysis
be added to the PQ List.\163\
---------------------------------------------------------------------------

    \160\ NERC Initial Comments at 4.
    \161\ MISO Transmission Owners consist of: Ameren Services
Company, as agent for Union Electric Company d/b/a Ameren Missouri,
Ameren Illinois Company d/b/a Ameren Illinois and Ameren
Transmission Company of Illinois; American Transmission Company LLC;
Big Rivers Electric Corporation; Central Minnesota Municipal Power
Agency; City Water, Light & Power (Springfield, IL); Cleco Power
LLC; Dairyland Power Cooperative; Duke Energy Business Services, LLC
for Duke Energy Indiana, LLC; East Texas Electric Cooperative;
Entergy Arkansas, LLC; Entergy Louisiana, LLC; Entergy Mississippi,
LLC; Entergy New Orleans, LLC; Entergy Texas, Inc.; Great River
Energy; GridLiance Heartland LLC; Hoosier Energy Rural Electric
Cooperative, Inc.; Indiana Municipal Power Agency; Indianapolis
Power & Light Company; Lafayette Utilities Systems; MidAmerican
Energy Company; Minnesota Power (and its subsidiary Superior Water,
L&P); Montana-Dakota Utilities Co.; Northern Indiana Public Service
Company LLC; Northern States Power Company, a Minnesota corporation,
and Northern States Power Company, a Wisconsin corporation,
subsidiaries of Xcel Energy, Inc.; Northwestern Wisconsin Electric
Company; Otter Tail Power Company; Prairie Power, Inc.; Republic
Transmission, LLC; Southern Illinois Power Cooperative; Southern
Indiana Gas & Electric Company (d/b/a CenterPoint Energy Indiana
South); Southern Minnesota Municipal Power Agency; Wabash Valley
Power Association, Inc.; and Wolverine Power Supply Cooperative,
Inc.
    \162\ Microsoft Initial Comments at 2; MISO Transmission Owners
Initial Comments at 6-7; EEI Initial Comments at 5-6.
    \163\ EEI Initial Comments at 5-6.
---------------------------------------------------------------------------

    80. DOE states that the PQ List should be expanded to include other
information sharing programs, as well as permit case-by-case basis
evaluation of other investments.\164\ When considering whether to
expand eligible information-sharing programs on the PQ List, DOE
recommends that the Commission consider whether investments for
participating in other Department-led cybersecurity programs, such as
C2M2, materially improve the security posture of the utility.\165\ DOE
suggests the specific inclusion of the Cybersecurity for the
Operational Technology Environment program on the PQ List.\166\ EEI
broadly suggests that the Commission expand the PQ List to include
other federally funded or supported cybersecurity threat information
sharing programs.\167\
---------------------------------------------------------------------------

    \164\ DOE Reply Comments at 6-12.
    \165\ Id. at 10.
    \166\ Id.
    \167\ EEI Initial Comments at 6.
---------------------------------------------------------------------------

    81. Anterix recommends that the Commission include expenditures for
private LTE wireless broadband communication systems as an item
eligible for incentives on the PQ List.\168\ MISO Transmission Owners
and International Transmission Companies

(ITC Companies) \169\ recommend that the Commission add expenditures
for utility-owned private fiber networks to the PQ List, as well as
expenditures made to upgrade or replace legacy operating systems.\170\
They further suggest that the Commission should expand the PQ List to
include advanced cybersecurity expenditures to address physical
security, such as biometric identification, access cards or access
control systems.\171\
---------------------------------------------------------------------------

    \168\ Anterix Initial Comments at 5.
    \169\ ITC Companies d/b/a ITCTransmission, Michigan Electric
Transmission Company, LLC, ITC Midwest LLC, and Great Plains, LLC.
    \170\ MISO Transmission Owners Initial Comments at 6-7; ITC
Companies Initial Comments at 5-6.
    \171\ MISO Transmission Owners Initial Comments at 6-7; ITC
Companies Initial Comments at 5-6.
---------------------------------------------------------------------------

    82. Microsoft and EEI both recommend inclusion of user and endpoint
behavioral analysis.\172\ Avangrid and the Operational Technology
Cybersecurity Coalition (OT Coalition) advocate for the addition of
hardware and software risk management tools aimed to help identify
cybersecurity threats to suppliers and vendors.\173\ MISO Transmission
Owners additionally propose that the Commission expand the PQ List to
include cybersecurity expenditures such as for DHS's CyberSentry
hardware and software.\174\
---------------------------------------------------------------------------

    \172\ Microsoft Initial Comments at 2; EEI Initial Comments at
6-7.
    \173\ Avangrid Initial Comments at 6; OT Coalition Initial
Comments at 3.
    \174\ MISO Transmission Owners Initial Comments at 6.
---------------------------------------------------------------------------

    83. Microsoft recommends expanding the PQ List to include cloud-
enabled security solutions, threat intelligence, vulnerability
assessment, access control and privileged access management, endpoint
detection and response, firewall and network management, and
multifactor authentication and biometrics.\175\ EEI suggests that the
Commission consider adding technology and processes to develop threat
hunting capability within IT and OT environments (e.g., incident
response retainer fees, penetration tests, or vulnerability
assessments; secure coding practices and consulting services to
navigate Software Bill of Materials requirements; and data loss
prevention capabilities).\176\
---------------------------------------------------------------------------

    \175\ Microsoft Initial Comments at 2.
    \176\ EEI Initial Comments at 5-6.
---------------------------------------------------------------------------

iii. Commission Determination
    84. We adopt and modify the NOPR's proposal and add Sec.
35.48(e)(1) to the Commission's regulations to include two
cybersecurity investments on the initial PQ List: (1) cybersecurity
investments associated with participation in CRISP and (2)
cybersecurity investments associated with internal network security
monitoring within the utility's cyber systems. We find that both of
these cybersecurity investments satisfy the eligibility criteria and
both merit the rebuttable presumption.
    85. First, we include cybersecurity investments associated with a
utility's participation in CRISP. We find that a utility's
participation in CRISP materially improves cybersecurity because it
involves utility participation in a cybersecurity threat information
sharing program. We note that such participation falls under the
recommendations in the NIST SP 800-53 Security and Privacy Controls for
Information Systems and Organizations catalog. In addition, CRISP: (1)
is facilitated by the Federal Government; (2) provides two-way
communications from and to electric industry and government entities;
and (3) delivers relevant and actionable cybersecurity information to
participants within the United States electricity industry. Having
found that participation in CRISP satisfies the first eligibility
criterion, we include it on the initial PQ List.
    86. We are aware that many, but not all, utilities already
participate in CRISP. Our inclusion of CRISP on the initial PQ List
reflects the mandate in FPA section 291A(c) to establish incentive-
based rate treatments by encouraging participation in cybersecurity
threat information sharing programs. The mandate to incentivize
participation indicates that all CRISP participants, not just new
entrants, should be eligible to seek an incentive for any new
cybersecurity investment associated with their participation, so long
as that participation is voluntary.
    87. Second, we include cybersecurity investments associated with a
utility's investment in internal network security monitoring within the
utility's cyber systems. As the Commission explained in the NOPR, a
utility's cybersecurity investments associated with internal network
security monitoring could include IT cyber systems and/or OT cyber
systems and could be associated with cyber systems that may or may not
be subject to the Reliability Standards.
    88. We find that cybersecurity investments associated with internal
network security monitoring within the utility's cyber systems
materially improves cybersecurity because they are investments in
Advanced Cybersecurity Technology. Internal network security monitoring
falls under the recommendations in the NIST SP 800-53 Security and
Privacy Controls for Information Systems and Organizations catalog.
Having found that cybersecurity investments associated with internal
network security monitoring within the utility's cyber systems
satisfies the first eligibility criterion, we will include it on the
initial PQ List.
    89. NERC observes that some utilities may already use internal
network security monitoring as part of their compliance with
Reliability Standards and therefore cautions that it may be difficult
to determine whether a particular cybersecurity investment is mandatory
for purposes of determining whether such expenditures would qualify for
incentive-based rate treatment. We have addressed this concern
primarily in section III.A.3.c., and we reiterate that a utility's
cybersecurity investments, including internal network security
monitoring, made to comply with a Reliability Standard, will not be
incentive-eligible because the utility did not make those investments
voluntarily. However, there may be instances where a utility invests in
internal network security monitoring that while complying with a
Reliability Standard also provides enhanced cybersecurity protections
that go beyond compliance with a Requirement in the Reliability
Standard.\177\ Those incremental cybersecurity investments in internal
network security monitoring that go beyond compliance with a
Requirement in a Reliability Standard would be eligible for incentive-
based rate treatment provided that the utility demonstrates that the
incremental cybersecurity investments satisfy the eligibility
criteria.\178\ With regard to NERC's concern regarding the potential
difficulty of discerning which cybersecurity investments for internal
network security monitoring qualify for incentive-based rate treatment,
it is incumbent upon the utility to demonstrate in its filing seeking
an incentive that the associated expenses are for new internal network
security monitoring that is in addition to its preexisting
cybersecurity programs and go beyond compliance with a Requirement in
the Reliability Standard.
---------------------------------------------------------------------------

    \177\ See infra section III.C.2.c. (discussing the availability
of incentive-based rate treatment for new cybersecurity
investments).
    \178\ We discuss in section III.D.3.c. the types of information
that a utility would need to include in is filing of a request for
incentive-based rate treatment for its cybersecurity investment. A
utility seeking an incentive-based rate treatment for the
incremental voluntary portion of its cybersecurity investment would
need to identify its additional, voluntary cybersecurity investments
that exceed the legal requirement. The utility would also need to
distinguish the portion of the cybersecurity investment it made to
comply with a legal requirement from the voluntary portion.
---------------------------------------------------------------------------

    90. We decline at this time to add any additional cybersecurity
investments to

the initial PQ List. Because of the rebuttable presumption afforded to
items on the PQ List, it is important that the Commission have a high
degree of confidence that such items will likely materially improve
cybersecurity for all utilities. While many of the additional
cybersecurity investments commenters suggest to include on the initial
PQ List may indeed be beneficial investments that would improve
cybersecurity, we find that suggestions offered by commenters either
lack sufficient evidence to show they will materially improve
cybersecurity across all utilities or lack sufficient specificity to be
included on the PQ List at this time.
    91. As discussed in section III.B.1.a., the Commission will, from
time to time, evaluate whether it would be appropriate to modify the PQ
List. As the Commission updates the PQ List over time, entities may
propose to add the items that the Commission does not accept in this
final rule as well as other items, assuming that the entities can
provide adequate support as to why it is appropriate to include these
items. We also note that we are adding a case-by-case approach in
addition to the PQ List approach, and utilities can seek an incentive
for these investments on an individual basis, albeit without the
presumption of eligibility.
    92. In response to SecurityScorecard's suggestion that the
Commission broaden its focus from internal network security monitoring
to continuous monitoring, we do not agree that the PQ List should be so
expanded at this time, as we note that the CIP Reliability Standards
already mandate perimeter monitoring in some form. In response to
Microsoft and EEI's suggestions, we recognize the benefits of both the
Zero Trust security model and deploying Security Information and Event
Management processes. However, both are considered to be frameworks
that guide cybersecurity investments rather than specific cybersecurity
investments themselves. We note that the Commission could consider
providing incentives to specific applications of either the Zero Trust
security model or Security Information and Event Management on a case-
by-case basis, and, in the future, the Commission could consider adding
specific applications of these concepts to the PQ List.
    93. We disagree with UMLARC that community cyber force
informational-sharing programs should be on the PQ List. Community
cyber forces are currently pilot programs. By their nature as pilot
programs, community cyber forces do not have standardized specific
attributes, nor do they have a proven track record for placement on a
pre-qualified list. Given that we do not have a clear understanding of
these pilot programs or any associated investments, at this time, we
decline to add community cyber forces to the PQ List.
    94. We disagree with Anterix, MISO Transmission Owners, and ITC
Companies' proposals to include investments in private communication
systems such as LTE wireless and fiber networks on the PQ List. The use
of private communication systems does not necessarily provide a
cybersecurity benefit because the confidentiality of data transiting
those networks may not be encrypted.
    95. The MISO Transmission Owners recommend that the Commission
consider adding expenditures associated with the Department of Homeland
Security's CyberSentry hardware and software to the PQ List.\179\
CyberSentry is a pilot program, and the record in this proceeding does
not include enough evidence for us to determine whether CyberSenrty
would materially improve the cybersecurity of all utilities.
Nevertheless, CyberSentry uses sensors to monitor the IT and OT
Networks for cyber security threats, and incentive-based rate treatment
for these cybersecurity investments may already be eligible
cybersecurity investments as internal network security monitoring.
---------------------------------------------------------------------------

    \179\ Department of Homeland Security, ICS Security Offerings
Fact Sheet, https://www.cisa.gov/sites/default/files/publications/ics_security_offerings_fact_sheet_S508C.pdf (explaining that
``CyberSentry is a voluntary pilot program that leverages best in
breed, commercial off-the-shelf technologies, such as network
intrusion detection tools, to identify malicious activity in
Critical infrastructure (CI) ICS and corporate networks. CyberSentry
participation increases real-time visibility into U.S. CI and
provides the capability to detect nation-state adversaries on CI
networks and derive cross-sector analytic insights.'').
---------------------------------------------------------------------------

    96. DOE recommends that the Commission consider including the
Cybersecurity for the Operational Technology Environment
(CyOTETM) program on the PQ List. According to DOE, this
program enhances OT threat information-gathering for the energy
sector.\180\ CyOTE is currently under development, and the record in
this proceeding does not include enough evidence for us to determine
whether cybersecurity investments associated with CyOTE would
materially improve cybersecurity for all utilities. We find that MISO
Transmission Owners' and ITC Companies' proposals to include
investments made for physical access control systems, access cards, and
biometrics are beyond the scope for this proceeding because they are
not investments in Advanced Cybersecurity Technology or related to
participation in a cybersecurity threat information sharing program.
MISO Transmission Owners and ITC Companies also propose including
investments for upgrading or replacing legacy systems. We find there is
insufficient evidence in the record to determine whether the specific
applications could be considered cybersecurity investments.
Accordingly, we decline to include these investments on the PQ List.
---------------------------------------------------------------------------

    \180\ DOE, Cybersecurity for the Operational Technology
Environment (CyOTE), https://www.energy.gov/ceser/cybersecurity-operational-technology-environment-cyote (stating that CyOTE is a
``research initiative, led by CESER in partnership with Idaho
National Laboratory and energy sector partners, aims to develop
tools and capabilities that can provide energy asset owners and
operators with timely alerts and actionable information.'').
---------------------------------------------------------------------------

    97. Cybersecurity investments in Advanced Cybersecurity Technology
included on the PQ List must include at least one specific security
control that materially improves the cybersecurity of all utilities,
thus meriting a rebuttable presumption. We find that the proposals from
Microsoft and EEI to expand the PQ List to cover a broader set of
advanced cybersecurity solutions such as threat intelligence,
vulnerability management, access control, and others are vague and lack
the specificity needed to establish a record for inclusion on the PQ
List. Proposals from Avangrid and the OT Coalition to include
investments for hardware and software risk management tools similarly
lack specificity. We therefore decline to include these investments on
the PQ List at this time.
    98. While proposals from EEI to consider investments related to
threat hunting, penetration tests, and consulting services for Software
Bill of Materials requirements describe efforts to detect cybersecurity
vulnerabilities, they also lack specificity with regard to mitigation
and remediation of identified deficiencies. Microsoft and EEI both
propose including investments for user and endpoint behavioral
analysis, and NERC proposes including investments for the deployment of
OT sensors. However, commenters do not demonstrate that these items are
different in scope than what is already covered by internal network
security monitoring on the PQ List. Therefore, we decline to include
these investments on the PQ List at this time.
    99. As discussed in section III.B.1.a., the Commission will, from
time to time, evaluate whether it would be appropriate to modify the PQ
List. We also note that, because we are adding a case-by-case approach
in addition to the PQ List approach, utilities can seek an incentive
for investments not identified

on the PQ List, albeit without the presumption of eligibility.
2. Case-by-Case Approach
a. NOPR Proposal
    100. In the NOPR, the Commission recognized the limitations of only
adopting the PQ List approach and sought comment on whether and, if so,
how it should implement a case-by-case approach to grant
incentives.\181\ The Commission explained that it could permit a
utility to file for incentive-based rate treatment for any
cybersecurity investment that the utility believes satisfies the
eligibility criteria, and that the Commission would review such filings
on a case-by-case basis, to determine whether the proposed
cybersecurity expenditure satisfies the eligibility criteria.
---------------------------------------------------------------------------

    \181\ NOPR, 180 FERC ] 61,189 at P 32.
---------------------------------------------------------------------------

    101. The Commission further explained that its evaluation of a
utility's application under the case-by-case approach would differ from
its evaluation of a filing seeking incentives for items on the PQ List,
although the eligibility criteria would be the same under either
approach. Specifically, the case-by-case application would not receive
a presumption of eligibility for any cybersecurity investment and the
utility would bear the full burden to demonstrate in its filing that
its cybersecurity investment meets the eligibility criteria. Just as it
would in a filing for incentive treatment of a cybersecurity investment
on the PQ List, the filing utility would also need to demonstrate that
its proposed rate, inclusive of the incentive, is just and reasonable.
b. Comments
    102. OT Coalition, Avangrid, MISO Transmission Owners, EPSA, INGAA,
EEI, Microsoft, Ohio Consumers' Counsel, Anterix, and DOE support the
adoption of a case-by-case approach in addition to the PQ List
approach.\182\ Alliant and the Maryland and Pennsylvania Commissions
support the adoption of a case-by-case approach instead of the PQ List
approach.\183\ TAPS, the Michigan Commission, APPA, and California
Parties oppose the Commission adoption of a case-by-case approach.\184\
---------------------------------------------------------------------------

    \182\ OT Coalition Initial Comments at 2-3; Avangrid Initial
Comments at 5, 6. MISO Transmission Owners Initial Comments at 4;
EPSA Initial Comments at 5; INGAA Initial Comments at 4; EEI Initial
Comments at 4-5; Microsoft Initial Comments at 2; Ohio Consumers'
Counsel Initial Comments at 9; Anterix Initial Comments at 12-13;
Anterix Reply Comments at 12; DOE Reply Comments at 10.
    \183\ Alliant Initial Comments at 4-5; Maryland and Pennsylvania
Commissions Initial Comments at 7-8.
    \184\ TAPS Initial Comments at 7; Michigan Commission Initial
Comments at 6; APPA Initial Comments at 5; California Parties
Initial Comments at 31-32; California Parties Reply Comments at 12-
13.
---------------------------------------------------------------------------

    103. EEI, MISO Transmission Owners, INGAA, and Anterix describe the
role of a case-by-case approach as a supplement to the PQ List
approach, providing flexibility for the filing utilities.\185\
Microsoft, OT Coalition, and Ohio Consumers' Counsel highlight the use
of the case-by-case approach as a mechanism both for utilities to file
for incentives not on the PQ List and to inform additions to the PQ
List.\186\ INGAA asserts that the case-by-case approach will encourage
utilities to make qualifying investments not included on the PQ List,
which will result in strengthening the security posture of the Bulk-
Power System.\187\ Avangrid states that the Commission should allocate
sufficient human and financial resources to ensure timely review of
case-by-case incentive requests.\188\
---------------------------------------------------------------------------

    \185\ EEI Initial Comments at 4-5; MISO Transmission Owners
Initial Comments at 4; INGAA Initial Comments at 4; Anterix Initial
Comments at 12-13; Anterix Reply Comments at 12.
    \186\ Microsoft Initial Comments at 2; OT Coalition Initial
Comments at 2, 3; Ohio Consumers' Counsel Initial Comments at 9.
    \187\ INGAA Initial Comments at 4.
    \188\ Avangrid Initial Comments at 4.
---------------------------------------------------------------------------

    104. Alliant and the Maryland and Pennsylvania Commissions support
the adoption of a case-by-case approach over the PQ List. Alliant
argues that, due to the dynamic and rapid pace at which cybersecurity
solutions become obsolete, the case-by-case approach will allow the
Commission to review incentive requests in light of the most current
technologies available and the overall needs of the utility.\189\ The
Maryland and Pennsylvania Commissions assert that the case-by-case
approach would encourage utilities to be more innovative in their
cybersecurity improvements and allows an applicant to demonstrate how a
particular incentive addresses the utility's actual needs or meets the
statutory criteria specific to the individual utility.\190\ Ohio FEA
argues that the PQ List approach alone is an inadequate approach
because it will be unable to stay abreast of the ever-changing
cybersecurity landscape.\191\
---------------------------------------------------------------------------

    \189\ Alliant Initial Comments at 4-5.
    \190\ Maryland and Pennsylvania Commissions Initial Comments at
7-8.
    \191\ Ohio FEA Initial Comments at 9.
---------------------------------------------------------------------------

    105. TAPS, the Michigan Commission, APPA, and California Parties
oppose the adoption of the case-by-case approach. The Michigan
Commission supports the transparency and efficiency that the PQ List
provides over the case-by-case approach.\192\ The Michigan Commission
argues that, if a cybersecurity investment materially improves
security, the investment should be considered for inclusion in the CIP
Reliability Standards.\193\ TAPS also enumerates concerns with the
efficiency and transparency of the case-by-case approach, as well as
the potential for increased litigation expenses and slower adoption of
Advanced Cybersecurity Technologies.\194\ APPA states that the case-by-
case approach would be administratively burdensome and lead to
incentives for routine, best practice cybersecurity expenditures.\195\
California Parties argue that a case-by-case approach would be
administratively infeasible and reduce regulatory certainty for filing
utilities.\196\
---------------------------------------------------------------------------

    \192\ Michigan Commission Initial Comments at 6.
    \193\ Id. at 9.
    \194\ TAPS Initial Comments at 7-9.
    \195\ APPA Initial Comments at 17.
    \196\ California Parties Initial Comments at 31-32.
---------------------------------------------------------------------------

    106. The Iowa Utilities Board states that incentives under the
case-by-case approach should be higher than those granted under the PQ
List because the case-by-case approach drives innovation.\197\
---------------------------------------------------------------------------

    \197\ Iowa Utilities Board Initial Comments at 5-6.
---------------------------------------------------------------------------

c. Commission Determination
    107. We adopt a case-by-case approach to granting incentives by