adding Sec.  35.48(e)(2) to the Commission's regulations, which permits
a utility to demonstrate that a cybersecurity investment satisfies each
of the eligibility criteria. Unlike the PQ List approach, the
Commission will not presume that the requested cybersecurity investment
satisfies the eligibility criteria. The utility requesting incentive-
based rate treatment would need to demonstrate in its filing that the
cybersecurity investment(s) would materially improve cybersecurity for
the utility requesting the incentive-based rate treatment.
    108. We find that allowing utilities to make case-by-case
cybersecurity incentive requests in addition to PQ List requests
provides several benefits. The case-by-case approach offers greater
flexibility than the PQ List approach alone for utilities to respond to
cybersecurity threats. In addition, reviewing cybersecurity investments
on a case-by-case basis can help to inform the Commission about
potential new additions that it could make to the PQ List in future
proceedings. We believe

that, by allowing utilities to use more than one approach to show that
a cybersecurity investment satisfies the eligibility criteria, we
strike the right balance between customer protection, transparency,
efficiency, and responsiveness to cybersecurity threats.
    109. In order to determine on a consistent and transparent basis
whether a cybersecurity investment satisfies the first eligibility
criterion, the Commission will consider evidence showing that the
utility would invest in cybersecurity improvements that: (1) are based
on a documented and recommended technical cybersecurity mitigation
action published in an alert or advisory by a relevant Federal agency
(e.g., CISA, DOE, FBI, DOD, NSA); \198\ and (2) respond to an alert or
advisory that meets the objective of a subcategory of the NIST
Cybersecurity Framework, or its successor, and references the related
NIST 800-53 Security Control, or its successor.\199\ The Commission
would base its assessment of the evidence on whether an incentive is
appropriate on the mitigation actions detailed in the specified
agencies' alerts and advisories along with the NIST Cybersecurity
Framework and NIST 800-53 Security Controls to determine whether the
utility's proposed cybersecurity investment would materially improve
its cybersecurity.
---------------------------------------------------------------------------

    \198\ Technical cybersecurity mitigation action means a
recommended action requiring the purchase of software, hardware, or
third-party services.
    \199\ Some alerts may reference specific NIST 800-53 Security
Controls, while others may reference security controls generally.
One example of a case-by-case request for incentive-based rate
treatment of cybersecurity investments is a utility requesting an
incentive for an implementation of data backup procedures on both
the IT and OT networks. This type of action is specifically
recommended in the CISA ``Shields Up'' Alert. See CISA, Essential
Element: Your Data (Oct. 15, 2020), https://www.cisa.gov/sites/default/files/publications/Cyber%20Essentials%20Toolkit%205%2020201015_508.pdf. Further, this
action is covered by the NIST Cybersecurity Framework Category
Information Protection Processes and Procedures, subcategory 4 and
thus would be evidence that this proposed implementation would
materially improve the utility's cybersecurity.
---------------------------------------------------------------------------

    110. As discussed in section III.A.3. and consistent with the
Commission's evaluations of PQ List cybersecurity investments in
section III.B.1.a., under the case-by-case approach a utility would
still need to demonstrate that it would make the cybersecurity
investment voluntarily, and that the proposed rate, including the
cybersecurity incentive, is just and reasonable and not unduly
discriminatory or preferential.
    111. We decline to add any additional eligibility criteria to our
regulations that would apply only to cybersecurity investments that are
not included on the PQ List. We find that the eligibility criteria in
our regulations are sufficient for incentive requests that use either
the PQ List or case-by-case approach. Similarly, we decline to offer
different forms of incentives for cybersecurity investments based on
whether or not the investment appears on the PQ List. We are not
convinced that the benefits of cybersecurity investments made that are
on the PQ List or for which a utility requests incentives on a case-by-
case basis differ and would therefore merit disparate incentive levels
because all incentive-eligible investments under both mechanisms must
satisfy the requirement to materially improve cybersecurity in the
first eligibility criterion.
3. Early Compliance With Approved Reliability Standards
a. NOPR Proposal
    112. In the NOPR, the Commission proposed the second eligibility
criterion limiting incentive-based rate treatment to cybersecurity
investments that a utility made voluntarily.\200\ The NOPR also sought
comment on whether the second eligibility criterion was appropriate and
whether there were additional criteria or limitations that the
Commission should consider, including any potential refinements, and
any other criteria for incentive eligibility that the Commission should
adopt in the final rule. Finally, the NOPR proposed to allow a utility
granted a cybersecurity incentive to receive that incentive until the
investment or activity that serves as the basis of that incentive
become mandatory pursuant to a Reliability Standard approved by the
Commission.\201\ This would include cybersecurity investments made by a
utility to comply with Reliability Standards that the Commission has
already approved pursuant to Sec.  39.5(d) of the Commission's
regulations, but that have not yet taken effect pursuant to the
implementation plan approved by the Commission.
---------------------------------------------------------------------------

    \200\ Id. PP 20, 22.
    \201\ Id. P 46.
---------------------------------------------------------------------------

b. Comments
    113. Many commenters discuss how the NOPR's proposed incentives
would interact with and affect the CIP Reliability Standards and
development processes. Indicated PJM Transmission Owners, the Michigan
Commission, and EPSA note that incentives could supplement the time-
intensive NERC standards development process.\202\ APPA and Alliant
express concern that providing incentives for cybersecurity investments
would disincentivize the timely development of CIP Reliability
Standards.\203\ NERC advises the Commission to develop rate incentives
for voluntary cybersecurity investments that build upon and complement
existing CIP Reliability Standards.\204\ NERC and TAPS advise the
Commission to consider how the proposed incentives will affect
compliance with the CIP Reliability Standards.\205\
---------------------------------------------------------------------------

    \202\ Indicated PJM Transmission Owners Initial Comments at 5;
Michigan Commission Initial Comments at 9; EPSA Initial Comments at
2.
    \203\ APPA Initial Comments at 13-14; Alliant Initial Comments
at 7-8.
    \204\ NERC Initial Comments at 3.
    \205\ Id. at 4; TAPS Initial Comments at 12.
---------------------------------------------------------------------------

    114. Indicated PJM Transmission Owners support the availability of
incentives to early adopters of cybersecurity technology.\206\ The
Michigan Commission discusses an approach in which the proposed
Cybersecurity Regulatory Asset Incentive would be used to facilitate
cybersecurity investments during the period in which said investments
are evaluated for inclusion in the CIP Reliability Standards.\207\ EPSA
notes that the nature of the long, detailed process to develop and
implement NERC CIP Reliability Standards may not be able to keep up
with the rapidly evolving nature of cybersecurity threats.\208\ EPSA
states that it is prudent to provide incentives for protections to
address rapidly evolving technologies to ensure a reliable, resilient,
and operational electric grid.\209\
---------------------------------------------------------------------------

    \206\ Indicated PJM Transmission Owners Initial Comments at 5.
    \207\ Michigan Commission Initial Comments at 9.
    \208\ EPSA Initial Comments at 2.
    \209\ Id.
---------------------------------------------------------------------------

    115. The Maryland and Pennsylvania Commissions argue that making
incentives available in the period before the completion of mandatory
standards does not expedite the standards process or the voluntary
adoption of improvements.\210\ On the contrary, they assert that the
proposed incentives actually would encourage delays in the standards
development process so utilities could recover incentives for voluntary
implementation.\211\ The Maryland and Pennsylvania Commissions further
note that the proposed incentives do not provide a tapering off period,
such as over the time frame in which a CIP Reliability Standard is
being developed. They assert that such a tapering period would

motivate utilities to implement material improvements as early as
possible.\212\
---------------------------------------------------------------------------

    \210\ Maryland and Pennsylvania Commissions Initial Comments at
10.
    \211\ Id. at 10.
    \212\ Id. at 10.
---------------------------------------------------------------------------

    116. APPA recommends that the Commission modify the proposed
eligibility criteria in a manner that would disallow incentives for
early adoption of CIP Reliability Standards.\213\ Instead of a
cybersecurity expenditure losing eligibility when it becomes mandatory
pursuant to a CIP Reliability Standard, APPA recommends that the cut
off for incentives should be the earlier of: (1) the date of any
Commission directive that would require the investment; or (2) the date
that a Standards Authorization Request is submitted to NERC to require
that incentive.\214\ APPA argues that it would not be just or
reasonable to provide an incentive to a utility for an investment where
a new or revised mandatory Reliability Standard is pending.\215\
---------------------------------------------------------------------------

    \213\ APPA Initial Comments at 13-14.
    \214\ Id. at 13-14.
    \215\ Id. at 13-14.
---------------------------------------------------------------------------

c. Commission Determination
    117. We adopt an application of the case-by-case method for
utilities to satisfy the eligibility criteria by adding Sec.
35.48(e)(3) to the Commission's regulations, which permits utilities to
receive incentives for cybersecurity investments made to comply with a
cybersecurity-related CIP Reliability Standard (i.e., excluding CIP
Reliability Standards that may be related to physical security and not
cybersecurity) approved by the Commission before that CIP Reliability
Standard becomes mandatory and enforceable for that utility. In
general, cybersecurity investments made by a utility to comply and
maintain its compliance with a Commission-approved Reliability Standard
will materially improve the utility's cybersecurity. Filing utilities
would need to demonstrate that the cybersecurity investment(s) it will
make are necessary to comply with the Reliability Standard, and that it
will make those cybersecurity investments prior to the date that the
Reliability Standard is mandatory and enforceable for that
utility.\216\ Those cybersecurity investments made by the utility
before the newly-approved Reliability Standard becomes effective (i.e.,
mandatory and enforceable) are voluntary. Those cybersecurity
investments made by the utility after the newly-approved Reliability
Standard becomes effective and mandatory are no longer voluntary. As
required by the second eligibility criteria, all of the utility's
cybersecurity investments incurred to comply with a Reliability
Standard after the Reliability Standard becomes mandatory and
enforceable for that utility are ineligible for incentive-based rate
treatment.
---------------------------------------------------------------------------

    \216\ In addition, as explained below, filings seeking the
incentives would have to comply with the filed rate doctrine. See
Exxon Mobil Corp. v. FERC, 571 F.3d 1208, 1211 (D.C. Cir. 2009)
(citing Towns of Concord, Norwood, & Wellesley v. FERC, 955 F.2d 67,
71 & n.2 (D.C. Cir. 1992); Ark. La. Gas Co. v. Hall, 453 U.S. 571,
577-578 (1981)) (``The Commission may not retroactively alter a
filed rate to compensate for prior over- or underpayments. A
corollary to this rule against retroactive ratemaking, the filed
rate doctrine, forbids a regulated entity to charge rates for its
services other than those properly filed with the appropriate
regulatory authority. Together, these rules generally limit the
relief the Commission may order to prospective [rates].'') (cleaned
up).
---------------------------------------------------------------------------

    118. We find that allowing utilities to receive an incentive to
comply with a Commission-approved cybersecurity-related CIP Reliability
Standard before it becomes mandatory and enforceable could materially
improve their cybersecurity posture during that period. In addition, we
find that permitting an incentive for early compliance with approved
cybersecurity-related CIP Reliability Standards will help to bridge
gaps between voluntary cybersecurity measures and the cybersecurity
measures mandated in the CIP Reliability Standards. It is possible that
allowing utilities to receive incentives for early compliance could
unintentionally incentivize standards drafting teams' artificial
lengthening of the implementation period to increase the amount of time
a utility could receive incentives. Nevertheless, the Commission would
continue to consider whether the implementation time is reasonable when
determining whether to approve the proposed CIP Reliability
Standard.\217\
---------------------------------------------------------------------------

    \217\ See Rules Concerning Certification of the Elec.
Reliability Org.; & Procs. for the Establishment, Approval, & Enf't
of Elec. Reliability Standards, Order No. 672, 71 FR 8662 (Feb. 17,
2006), 114 FERC ] 61,104, at P 333, order on reh'g, Order No. 672-A,
71 FR 19814 (Apr. 18, 2006), 114 FERC ] 61,328 (2006) (``In
considering whether a proposed Reliability Standard is just and
reasonable, the Commission will consider also the timetable for
implementation of the new requirements, including how the proposal
balances any urgency in the need to implement it against the
reasonableness of the time allowed for those who must comply'').
---------------------------------------------------------------------------

    119. We clarify that the cybersecurity investments made by a
utility to achieve early compliance with an approved cybersecurity-
related CIP Reliability Standard may be eligible for incentive-based
rate treatment. We reiterate that, after receiving Commission
authorization for incentive-based rate treatment, the utility may only
collect the incentive during the period that begins with the utility
achieving compliance with the approved cybersecurity-related CIP
Reliability Standard and that ends according to the duration provisions
of Sec.  35.48(g), as further discussed in section III.D.\218\
Therefore, the earlier that a utility complies with a new CIP
Reliability Standard, the longer the utility's incentive recovery
period may be.
---------------------------------------------------------------------------

    \218\ In addition to having its rate that includes incentive-
based treatment on file with the Commission, a utility must submit
an informational filing to the Commission notifying the Commission
of the date that it has achieved compliance with the approved
cybersecurity-related CIP Reliability Standard.
---------------------------------------------------------------------------

C. Cybersecurity Investment Rate Incentives

    120. The Commission proposed two potential rate incentive options
for utilities that make eligible cybersecurity investments: (1) the
Cybersecurity ROE Incentive, an ROE adder of 200 basis points that
would be applied to the incentive-eligible investments; \219\ and (2)
the Cybersecurity Regulatory Asset Incentive, deferral of certain
eligible expenses for rate recovery, enabling them to be part of rate
base such that a return can be earned on the unamortized portion.\220\
The Commission stated that both offer meaningful incentives to
encourage cybersecurity investments that improve a utility's
cybersecurity posture.\221\ The Commission also sought comment on
whether, and if so how, the principles of performance-based regulation
could apply to utilities with respect to cybersecurity
investments.\222\
---------------------------------------------------------------------------

    \219\ NOPR, 180 FERC ] 61,189 at P 36.
    \220\ Id. P 39.
    \221\ Id. P 33.
    \222\ Id. P 45.
---------------------------------------------------------------------------

    121. The Commission also noted that most utility IT investments
(general and intangible plant) and expenses (administrative and general
costs) support functions of the entire utility, not just the
transmission function.\223\ Consequently, the Commission found that
only a portion of those costs are allocated to transmission customers,
typically based on wages and salaries allocators.\224\
---------------------------------------------------------------------------

    \223\ Id. P 36.
    \224\ Id. P 36.
---------------------------------------------------------------------------

1. Cybersecurity ROE Incentive
a. NOPR Proposal
    122. The Commission proposed to allow a utility that makes
cybersecurity investments that are eligible for incentives to request
the Cybersecurity ROE Incentive that would be applied to the incentive-
eligible investments.\225\ The Commission explained that any

incentive granted under this proposal would be subject to the total
base and incentive return being capped at the top of the utility's zone
of reasonableness.\226\ The Commission stated that the 200-basis point
ROE adder would provide a meaningful incentive to encourage utilities
to improve their systems' cybersecurity. The Commission recognized that
this amount exceeds the ROE incentives for transmission facilities that
the Commission typically provides pursuant to FPA section 219. The
Commission explained that, because cybersecurity investments are
relatively small compared to conventional transmission projects, a
higher ROE may be necessary to affect the expenditure decisions of
utilities, without unduly burdening ratepayers.
---------------------------------------------------------------------------

    \225\ Id. P 36.
    \226\ See, e.g., Emera Me. v. FERC, 854 F.3d 9, 23 (D.C. Cir.
2017) (``The zone of reasonableness informs FERC's selection of a
just and reasonable rate.''); see also Permian Basin, 390 U.S. 747,
767 (1968) (stating that as long as the rate selected by the
Commission is within the zone of reasonableness, the Commission is
not required to adopt as just and reasonable any particular rate
level).
---------------------------------------------------------------------------

    123. The Commission also proposed that enterprise-wide investments,
which are not specific to transmission or the sale for resale of
electric energy in interstate commerce, but a portion of which are
recovered through rates on file with the Commission, may also be
eligible for the 200-basis point ROE adder incentive if the Commission
determines that the investments merit incentives, based on the
eligibility criteria described above.\227\ However, consistent with
both longstanding cost-causation ratemaking principles \228\ and the
statutory requirement that rates inclusive of incentives be just and
reasonable and not unduly discriminatory or preferential, the
Commission proposed that only the conventionally allocated portion of
such investments that flows through to cost-of-service rates on file
with the Commission would be eligible for this rate treatment.
---------------------------------------------------------------------------

    \227\ NOPR, 180 FERC ] 61,189 at P 37.
    \228\ See Old Dominion Elec. Coop. v. FERC, 898 F.3d 1254, 1255
(D.C. Cir. 2018), (``For decades, the Commission and the courts have
understood this requirement to incorporate a `cost-causation
principle'--the rates charged for electricity should reflect the
costs of providing it.''); see, e.g., Ala. Elec. Coop., Inc. v.
FERC, 684 F.2d 20, 27 (D.C. Cir. 1982).
---------------------------------------------------------------------------

b. Comments
    124. EEI, MISO Transmission Owners, and Indicated PJM Transmission
Owners support the proposed ROE incentive.\229\ EEI notes that some
cybersecurity investments involve relatively low dollar amounts,
compared with other capital investments.\230\ Therefore, in addition to
the fact that these investments are recovered over a short period, EEI
believes that the proposed 200-basis point adder is reasonable and has
the potential to create an incentive that will shift utility
cybersecurity expenditures in the manner intended by the Commission and
Congress.\231\
---------------------------------------------------------------------------

    \229\ EEI Initial Comments at 9; MISO Transmission Owners
Initial Comments at 10; Indicated PJM Transmission Owners Initial
Comments at 4.
    \230\ EEI Initial Comments at 9-10.
    \231\ Id. at 9-10.
---------------------------------------------------------------------------

    125. EEI and MISO Transmission Owners support the Commission's
proposal to include enterprise-wide costs as eligible for incentive
treatment.\232\ EEI states that the Commission's enterprise-wide
approach avoids the potential for investments to be funneled to only
certain assets, leaving other areas (e.g., network assets, generation)
potentially ineligible, and aligns with Commission policies on enabling
access for, and deployment of, distributed energy resources and
advanced technologies.\233\ MISO Transmission Owners state that the
inclusion of enterprise-wide costs encourages enterprise-wide strategic
security investments, which provide benefits to a utility's security
program efficiency more broadly, as well as to ratepayers.\234\
---------------------------------------------------------------------------

    \232\ MISO Transmission Owners Initial Comments at 10.
    \233\ EEI Initial Comments at 10.
    \234\ MISO Transmission Owners Initial Comments at 10-11.
---------------------------------------------------------------------------

    126. APPA and Alliant agree with the proposal in the NOPR to cap
total base and incentive ROE at the top of the zone of
reasonableness.\235\ APPA asks the Commission to clarify that, in
applying the cap at the top end of the zone of reasonableness, a public
utility would be required to take into account ROE adders other than
the cybersecurity investment adder.\236\
---------------------------------------------------------------------------

    \235\ APPA Initial Comments at 19; Alliant Initial Comments at
6.
    \236\ APPA Initial Comments at 19.
---------------------------------------------------------------------------

    127. Alliant, APPA, Iowa Utilities Board, Joint Consumer Advocates,
the Michigan Commission, Ohio FEA, Ohio Consumers' Counsel, and TAPS do
not support the proposed ROE adder of 200 basis points.\237\ Alliant,
APPA, California Parties, Ohio Consumers' Counsel, and Ohio FEA argue
that the proposed 200-basis points adder is not just and
reasonable.\238\ APPA, California Parties, and TAPS also argue that the
Commission has not sufficiently supported or explained why a 200-basis
point return is necessary.\239\
---------------------------------------------------------------------------

    \237\ Alliant Initial Comments at 6, APPA Initial Comments at
10; Iowa Utilities Board Initial Comments at 4; Joint Consumer
Advocates Initial Comments at 3; Michigan Commission at 9; Ohio FEA
Initial Comments at 10; TAPS Initial Comments at 16.
    \238\ Alliant Comments at 5-6; California Parties Initial
Comments at 22; ITC Companies Initial Comments at 3; Joint Consumer
Advocates Initial Comments at 3; Michigan Commission Initial
Comments at 9; Ohio Consumers' Counsel Initial Comments at 12; Ohio
FEA Initial Comments at 11.
    \239\ Alliant Comments at 5-6; APPA Initial Comments at 11;
California Parties Initial Comments at 22; Ohio Consumers' Counsel
Initial Comments at 12; Ohio FEA Initial Comments at 11.
---------------------------------------------------------------------------

    128. APPA, California Parties, and TAPS argue that eligible
cybersecurity investments are not ``relatively small'' as the NOPR
suggests.\240\ California Parties state that, in recent years, the
California Public Utilities Commission has authorized significant
amounts for State jurisdictional cybersecurity capital expenditures and
annual IT physical and cybersecurity activities for utilities.\241\
TAPS comments that the Commission has found that Duke Energy has made
over $137 million in capital investments as part of its cybersecurity
program that is designed based on the NIST Framework.\242\ TAPS further
states that, in 2019, Dominion Energy Virginia received State approval
to spend $910.3 million on cyber and physical security and
telecommunications over 10 years, with $154.4 being spent in the first
three years related to improved monitoring and alarm capabilities and
enhanced utility security.\243\ TAPS argues that these sums illustrate
that cybersecurity investments are not relatively small compared to
conventional transmission projects.\244\
---------------------------------------------------------------------------

    \240\ APPA Initial Comments at 11; California Parties Initial
Comments at 23; TAPS Initial Comments at 17.
    \241\ California Parties Initial Comments at 23.
    \242\ TAPS Initial Comments at 17.
    \243\ Id. at 17.
    \244\ Id. at 17.
---------------------------------------------------------------------------

    129. The Michigan Commission states that the potential financial
risks that cyberattacks can pose on electric utilities already serve as
a strong incentive for investment, much stronger than an additional 200
basis points would provide when applied to what the NOPR recognizes are
relatively low-cost investments.\245\
---------------------------------------------------------------------------

    \245\ Michigan Commission Initial Comments at 8-9.
---------------------------------------------------------------------------

    130. Alliant states that using a 200-basis point ROE incentive
would impose unnecessary administrative burdens on the Commission and
all parties affected, as processing requests for incentives would
consume valuable and limited resources of the Commission.\246\ Iowa
Utilities Board argues that an incentive rate adder could have a
cascading impact on

economic activity, might adversely impact inflation, and could provide
a perverse incentive to invest in unneeded technologies.\247\ Ohio
Consumers' Counsel comments that a 200-basis point adder is not
necessary and is unreasonably costly for consumers, and also defies the
logic of Order No. 679, which contemplated ROE adders of 100 and 150
basis points only, with the higher ROEs for more complicated and
expensive transmission projects.\248\
---------------------------------------------------------------------------

    \246\ Alliant Initial Comments at 6.
    \247\ Iowa Utilities Board Initial Comments at 4.
    \248\ Ohio Consumers' Counsel Initial Comments at 12-13.
---------------------------------------------------------------------------

    131. Several commenters argue for a modification to the
Commission's proposal of 200 basis points. NRECA requests that the
Commission revise its proposal to allow for a request of up to 200-
basis points, and questions whether it is appropriate to grant the same
ROE adder for all cybersecurity expenditures or whether the Commission
instead should tie the amount of the ROE incentive to the projected
impact of the cybersecurity expenditure.\249\ APPA asks whether the
Commission has considered whether applying a smaller ROE adder would be
sufficient to encourage investment.\250\ Ohio Consumers' Counsel states
that, instead of proposing a flat 200-basis point ROE adder, the
Commission should provide for a pool of potential adders, ranging from
25 basis points up to a cap of 50 basis points, depending on the
magnitude of the investment and the complexity or proven track record
for the technology or activity.\251\
---------------------------------------------------------------------------

    \249\ NRECA Initial Comments at 10.
    \250\ APPA Initial Comments at 11.
    \251\ Ohio Consumers' Counsel Initial Comments at 13.
---------------------------------------------------------------------------

    132. The Maryland and Pennsylvania Commissions suggest tapering
incentives over time to encourage utilities to implement material
improvements as early as possible. They argue that such tapering adds a
``performance-based'' aspect to the NOPR proposals.
    133. AEP and ITC Companies request that the Commission apply
incentives to the entire rate base.\252\ ITC Companies state that it
might be better to offer a general rather than asset-specific ROE adder
for utilities that adopt a sufficient level of additional Advanced
Cybersecurity Technologies and cybersecurity threat information sharing
program participation.\253\ ITC Companies argue that this would reflect
the fact that an entity's individual cybersecurity assets and practices
are part of a cohesive defensive framework that applies to its entire
operation.\254\ ITC Companies explain that the type of cybersecurity
investment to which the ROE incentive might apply is not a financially
significant portion of total rate base for most responsible entities
and, in many instances, it is likely that the marginal benefit of this
incentive will not justify the administrative cost of obtaining this
incentive (even with a PQ List in place), especially where the zone of
reasonableness applicable to a responsible entity's overall rate of
return further diminishes the impact of the incentive.\255\ AEP argues
that an incentive adder applied system-wide to the transmission rate
base would not need to rise to the level contemplated in the NOPR,
e.g., 50 basis points, and would be sufficient to incentivize industry
participants to adopt cybersecurity programs that go above and beyond
existing cybersecurity requirements.\256\
---------------------------------------------------------------------------

    \252\ AEP Initial Comments at 6; ITC Companies Initial Comments
at 4.
    \253\ ITC Companies Initial Comments at 4.
    \254\ Id. at 4.
    \255\ Id. at 3.
    \256\ AEP Initial Comments at 6.
---------------------------------------------------------------------------

c. Commission Determination
    134. We decline to adopt an ROE incentive adder, as proposed in the
NOPR. We conclude that the Cybersecurity Regulatory Asset Incentive
satisfies the statutory obligation to benefit consumers by encouraging
investments by utilities in Advanced Cybersecurity Technology and
participation by utilities in cybersecurity threat information sharing
programs. We believe that expenses, which include cybersecurity
assessments, architectural reviews, maturity model evaluations,
software subscriptions, monitoring, training, procuring outside
services, and cloud computing services, constitute a large portion of
overall expenditures for many cybersecurity investments, including
cybersecurity threat information sharing programs. We find that the
provision of the Cybersecurity Regulatory Asset Incentive alone
provides the encouragement that Congress intended without unduly
increasing costs on consumers.
2. Cybersecurity Regulatory Asset Incentive
a. NOPR Proposal
    135. The Commission proposed a Cybersecurity Regulatory Asset
Incentive to allow a utility that makes cybersecurity investments that
are eligible for incentives to seek deferred cost recovery.\257\ The
Commission explained that, in limited circumstances, it may be
appropriate to allow a utility to defer recovery of certain
cybersecurity costs that are generally expensed as they are incurred,
and treat them as regulatory assets, while also allowing such
regulatory assets to be included in transmission rate base. Many costs
associated with cybersecurity are in the form of expenses, often to
third-party vendors, rather than capital investments. Moreover, certain
cost categories that companies historically have purchased and
capitalized, such as software, are now often procured as services with
periodic payments to vendors that are recorded as expenses. Therefore,
to encourage investment in cybersecurity, the Commission proposed to
allow utilities to defer and amortize eligible costs that are typically
recorded as expenses, including those that are associated with third-
party provision of hardware, software, and computing and networking
services. The Commission also sought comment on whether it would be
preferable to permit only 50% of incentive-eligible expenses to be
treated as regulatory assets.
---------------------------------------------------------------------------

    \257\ NOPR, 180 FERC ] 61,189 at P 39.
---------------------------------------------------------------------------

    136. The Commission observed that a range of implementation costs
associated with cybersecurity investments could be eligible for
deferred rate treatment.\258\ Such costs may include, for example,
training to implement new cybersecurity practices and systems. However,
the Commission proposed that, to be eligible for the incentive of
deferred cost recovery, such training costs must be distinct from costs
associated with pre-existing training on cybersecurity practices. The
Commission stated that another potentially eligible implementation cost
may be internal system evaluations and assessments or analyses by third
parties, to the extent that they are associated with a capitalizable
item and are part of eligible capitalizable costs. The Commission
proposed that any implementation costs that are not conventionally
booked as plant and thus capitalized can be considered for deferral as
a regulatory asset. Recurring costs may be eligible for deferral as a
regulatory asset and may include, for example, subscriptions, service
agreements, and post-implementation training costs. Specifically, the
Commission proposed to allow utilities, under this incentive, to
include ongoing dues and other expenses directly associated with
participation by utilities in cybersecurity threat information sharing
programs that satisfy the eligibility criteria.
---------------------------------------------------------------------------

    \258\ Id. P 40.

---------------------------------------------------------------------------

    137. The Commission observed that, because FPA section 219A(c)(2)
directs the Commission to offer incentives to encourage participation
by public utilities in cybersecurity threat information sharing
programs, it proposed to allow utilities that are currently
participating in such programs to seek incentives for any new
cybersecurity investment associated with their participation, so long
as that participation is voluntary.\259\ The Commission sought comment
on whether to allow utilities who are already participating in an
eligible cybersecurity threat information sharing program to be
eligible for this incentive.\260\
---------------------------------------------------------------------------

    \259\ Id. P 41.
    \260\ Id. P 41.
---------------------------------------------------------------------------

    138. The Commission also noted that the Commission's rules and
regulations in the Uniform System of Accounts \261\ already require
public utilities to maintain records supporting any entries to the
regulatory asset account so that the public utility can furnish full
information as to the nature and amount of, and justification for, each
regulatory asset recorded in the account.\262\ The Commission explained
that, pursuant to its existing regulations, utilities must maintain
sufficient records to support the distinction of any investments that
are afforded incentive-based rate treatment.\263\
---------------------------------------------------------------------------

    \261\ See 18 CFR pt. 101, Account Definition Account 182.3,
Other Regulatory Assets, paragraph D.
    \262\ NOPR, 180 FERC ] 61,189 at P 42.
    \263\ Id.
---------------------------------------------------------------------------

    139. Additionally, the Commission proposed that only directly-
assigned utility costs or the conventionally allocated portion of
enterprise-wide expenses (e.g., using the wages and salaries allocator)
would be eligible for the Cybersecurity Regulatory Asset Incentive in
rates on file with the Commission.\264\
---------------------------------------------------------------------------

    \264\ Id. P 43.
---------------------------------------------------------------------------

b. Comments
    140. EEI, Iowa Utilities Board, the Michigan Commission, and MISO
Transmission Owners support the Commission's proposal.\265\ The
Michigan Commission states that the Commission's acknowledgement that
many cybersecurity costs have shifted to expenses rather than capital
costs is valid.\266\ The Michigan Commission adds that the proposed
Cybersecurity Regulatory Asset Incentive could help facilitate these
types of investments during the time in which such investments are
evaluated for inclusion in the CIP Reliability Standards, and that the
proposed Cybersecurity Regulatory Asset Incentive would allow for
reasonable facilitation of cybersecurity investments in advance of CIP
Reliability Standard updates and would avoid unjust and unreasonable
rates.\267\ Iowa Utilities Board comments that allowing a utility to
capitalize the operational expenses for cybersecurity expenditures is
by itself an adequate incentive because it reduces cash flow demands
and provides an opportunity for the utility to earn a return on those
expenditures.\268\
---------------------------------------------------------------------------

    \265\ EEI Initial Comments at 11; Iowa Utilities Board Initial
Comments at 3-4; Michigan Commission Initial Comments at 9; MISO
Transmission Owners Initial Comments at 11.
    \266\ Michigan Commission Initial Comments at 9.
    \267\ Id.
    \268\ Iowa Utilities Board Initial Comments at 4.
---------------------------------------------------------------------------

    141. MISO Transmission Owners support the proposal to allow
utilities to defer and amortize eligible costs that are typically
recorded as expenses that are associated with third-party hardware,
software, and computing and networking services.\269\ MISO Transmission
Owners state that allowing transmission owners to capitalize costs and
investments associated with cybersecurity investment, including up-
front training and implementation expenses, will enable utilities to
fully realize the relative security benefits that rapid adoption of
cybersecurity investment can generate, as well as the often-lower cost
that such solutions impose on ratepayers relative to physical
infrastructure.\270\
---------------------------------------------------------------------------

    \269\ MISO Transmission Owners Initial Comments at 11.
    \270\ Id.
---------------------------------------------------------------------------

    142. MISO Transmission Owners ask the Commission to clarify that
cybersecurity-related operation and maintenance expenses, labor costs,
and post-implementation training costs may be included as part of the
Cybersecurity Regulatory Asset Incentive.\271\ EEI suggests that the
Commission include training, implementation, software costs, and allow
cloud computing expenses to also be allowed to be deferred as a
regulatory asset.\272\ EEI expresses concern with the proposal to limit
the eligible costs to those associated with implementing cybersecurity
upgrades and to not include ongoing costs including system maintenance,
surveillance, and other labor costs, either in the form of employee
salaries or third-party service contracts.\273\ EEI argues that
including these costs would support the Commission's cybersecurity
goals, incent best practices, and benefit customers by reducing the
possibility of interruptions from cyber-attacks.\274\
---------------------------------------------------------------------------

    \271\ Id.
    \272\ EEI Initial Comments at 11.
    \273\ Id. at 11.
    \274\ Id. at 11-12.
---------------------------------------------------------------------------

    143. Ohio Consumers' Counsel opposes the proposal to allow deferred
accounting and recovery of a return on the unamortized portion of the
costs for cybersecurity expenses.\275\ Ohio Consumers' Counsel states
that deferred accounting and cost collection of cybersecurity expenses
as regulatory assets will cost consumers more over time than would
recovery of the expense all in one year.\276\
---------------------------------------------------------------------------

    \275\ Ohio Consumers' Counsel Initial Comments at 10.
    \276\ Id.
---------------------------------------------------------------------------

    144. APPA and California Parties contend that the Cybersecurity
Regulatory Asset Incentive should be limited to 50% of eligible
investment in cybersecurity initiatives.\277\ California Parties
comment that the Commission should allow no more than 50% of eligible
expenses to be treated as a regulatory asset included in transmission
rate base to reduce the burden on consumers.\278\ California Parties
argue that the Commission failed to offer any explanation as to why its
proposal that 100% of eligible expenses should be able to receive
incentive treatment is properly calibrated to induce the desired
investment.\279\
---------------------------------------------------------------------------

    \277\ APPA Initial Comments at 12; California Parties Initial
Comments at 24.
    \278\ California Parties Initial Comments at 24.
    \279\ Id. at 24.
---------------------------------------------------------------------------

c. Commission Determination
    145. We adopt the NOPR's proposal to add Sec.  35.48(f) to the
Commission's regulations to include a Cybersecurity Regulatory Asset
Incentive that allows a utility to seek deferred cost recovery for
cybersecurity investments that are eligible for incentives. We find
that, in limited circumstances that are specific to cybersecurity
investments, it is appropriate to allow a utility to defer recovery of
certain cybersecurity costs that are generally expensed as they are
incurred, and treat them as regulatory assets, while also allowing such
regulatory assets to be included in the utility's rate base.
    146. In response to Ohio Consumers' Counsel's concerns about
consumer costs, as an initial matter, we note that increased consumer
costs in isolation do not impugn the reasonableness of an incentive,
provided the rates are still just and reasonable. The Commission has
long offered transmission incentives, which increase rates, because
they encourage investments and activities that the Commission has found
provide consumer benefits. The Cybersecurity Regulatory Asset

Incentive nominally increases rates, though consumers benefit from the
time value of money associated with later recovery through rate base
than immediate recovery as an expense. Based on the expense-heavy
nature of many cybersecurity investments, we find this appropriate to
effectuate Congress' requirement that the Commission offer
cybersecurity incentives. We also will not, as suggested by California
Parties and APPA, limit this incentive to 50% of eligible expenses.
Given the comparatively small amount of many cybersecurity expenses, we
find that such a limitation may inadequately provide incentives to
meaningfully encourage utilities to improve their cybersecurity
posture.
    147. In response to MISO Transmission Owners' and EEI's comments,
we clarify that utilities may seek this incentive for a range of
expenses including operation and maintenance expenses, labor costs,
implementation costs, network monitoring, and training costs.
Additionally, ongoing expenses, either incurred by utility employees or
utility payments to third parties may be eligible. Software purchases
typically would not qualify for the Cybersecurity Regulatory Asset
Incentive because they generally constitute capital investments;
however, software-as-a-service expenses could qualify for the
Cybersecurity Regulatory Asset Incentive.
    148. We find it appropriate to limit eligibility for incentive-
based rate treatment to new cybersecurity investments. As also
discussed in section III.D.3.c., we add Sec.  35.48(h)(5) to our
regulations to provide that the Cybersecurity Regulatory Asset
Incentive may be applied to new cybersecurity investments that: (1)
occur after the effective date of the Commission's approval of
incentive-based rate treatment; and (2) are materially different from
cybersecurity investments already incurred by the utilities more than
three months prior to the incentive request. Utilities may seek
incentives for one-time cybersecurity expenses and/or recurring ones.
    149. We generally define new cybersecurity investments to include
investments for those activities that have occurred no more than three
months prior to the date that the utility files its incentive request
with the Commission. We provide one exception and one clarification to
this general three-month rule. First, a utility may seek incentive-
based rate treatment for its future cybersecurity investments made to
participate in cybersecurity threat information sharing programs even
if the utility began its participation and therefore made cybersecurity
investments related to its participation more than three months before
filing its request for incentive-based rate treatment with the
Commission. We clarify that utilities seeking incentive-based rate
treatment for cybersecurity investments made to comply with a
Commission-approved cybersecurity-related CIP Reliability Standard
before it becomes mandatory and enforceable for that utility will be
permitted to seek incentive-based rate treatment for its cybersecurity
expenses that began no earlier than three months before the date that
the Commission's approval of the Reliability Standard becomes
effective. A utility's cybersecurity expenses that began more than
three months before the date that the Commission order or final rule
approving a new or modified Reliability Standard becomes effective will
not be considered new and will be considered materially similar and
duplicative. Therefore, the cybersecurity investments made more than
three months before the Commission approves a new or modified
Reliability Standard would be ineligible to receive incentive-based
rate treatment as early compliance with an approved Reliability
Standard.
    150. To be clear, this prior three-month provision only determines
whether a utility's cybersecurity investment is new and therefore
eligible for incentive-based rate treatment. The filed rate doctrine
and the rule against retroactive ratemaking preclude the Commission
from granting a utility incentive-based rate treatment for
cybersecurity investments made before the Commission acts on a request
for declaratory order or the effective date of an FPA section 205
filing requesting the incentive-based rate treatment for cybersecurity
incentives.\280\
---------------------------------------------------------------------------

    \280\ See n.216, supra.
---------------------------------------------------------------------------

    151. Moreover, we find it appropriate that only new cybersecurity
investments, and not duplicative or materially similar ones to existing
expenses, be eligible. As discussed in section III.D.3., we will
require utilities to attest that the cybersecurity investments that are
the basis for the incentive-based rate treatments are new cybersecurity
investment and not duplicative or materially similar to preexisting
expenses. For instance, investment in training associated with a new
cybersecurity system may be eligible while annual basic cybersecurity
training may not, even if the contents slightly change year-to-year.
This will ensure that incentives encourage cybersecurity investments
that improve a utility's cybersecurity posture rather than just reward
ongoing or recurring activities. The three-month period to determine
eligibility of incentives for pre-existing expenses allows for
utilities making new cybersecurity investments to respond to immediate
cybersecurity vulnerabilities while giving them time to request
incentives. We reiterate that utilities may not recover incentives on
specific investments that predate the effective date of filing
requesting incentive-based rate treatment. We find that this grace
period could incentivize utilities not to wait until the effective date
of requested incentives to undertake urgent cybersecurity action.
    152. FPA section 219A(c)(2) requires the Commission to offer
incentives to encourage participation by public utilities in
cybersecurity threat information sharing programs. Furthermore,
participation in information-sharing programs provides cybersecurity
benefits to the participating utility that applies for an incentive-
based rate treatment, the other program participants, and their
customers. Consequently, unlike other expenses, we find that utilities
may request the Cybersecurity Regulatory Asset Incentive for expenses
associated with participation in cybersecurity threat information
sharing programs regardless of how long the utilities have participated
in the programs--although only expenses prospective from the effective
date of the Commission's approval of the cybersecurity incentives in
the utility's rate(s) on file with the Commission shall be eligible.
    153. The Commission's rules and regulations in the Uniform System
of Accounts \281\ require public utilities to maintain records
supporting any entries to the regulatory asset account so that the
public utility can furnish full information as to the nature and amount
of, and justification for, each regulatory asset recorded in the
account. Pursuant to our existing regulations, any utility receiving an
incentive must maintain sufficient records to support the distinction
of any investments that are afforded incentive-based rate
treatment.\282\ Given the novelty of allowing incentive recipients to
include certain expenses in rate base, it is essential that the
utilities keep records in a manner that allows the Commission and other
parties to ensure that no double-recovery occurs.
---------------------------------------------------------------------------

    \281\ See 18 CFR pt. 101, Account Definition Account 182.3,
Other Regulatory Assets, paragraph D.
    \282\ Id.

---------------------------------------------------------------------------

    154. We also find that, consistent with the Commission's
longstanding cost-causation ratemaking principles, only costs directly
assigned to a function or the conventionally allocated portion of
enterprise-wide expenses (e.g., using the wages and salaries allocator)
would be eligible for the Cybersecurity Regulatory Asset Incentive in
rates specific to that function. For example, only incentives for
transmission-specific or transmission-allocated costs may be recovered
in transmission rates.
3. Performance-Based Rates
a. NOPR Proposal
    155. In the NOPR, the Commission noted that FPA section 219A(c)
directs the Commission to establish incentive-based, including
performance-based, rate treatments.\283\ The Commission observed that,
because it is difficult to directly observe the level of effort a
utility expends on ensuring cybersecurity, performance-based regulation
could theoretically provide a valuable tool to motivate utilities to
maintain and operate their systems reliably and efficiently. The
Commission explained that performance-based ratemaking can take
multiple forms, but ultimately requires the ability to measure and tie
rate treatments to actual performance.\284\
---------------------------------------------------------------------------

    \283\ NOPR, 180 FERC ] 61,189 at P 44.
    \284\ Id. P 44.
---------------------------------------------------------------------------

    156. The Commission sought comment on performance-based rates and
whether and how the principles of performance-based regulation could
apply to utilities with respect to cybersecurity investments.\285\ The
Commission also sought comment on specific cybersecurity performance
metrics that could be subject to a performance standard.\286\ In
particular, the Commission sought comment on whether any widely
accepted metrics for cybersecurity performance could lend themselves as
benchmarks for performance-based rates, or whether new appropriate
metrics could be developed. The Commission further sought comment on
what rate mechanisms could accompany such metrics. The Commission asked
that any proposed mechanisms: (1) rely on cybersecurity performance
benchmarks and not expenditures or practices; and (2) consider
ratepayer impacts, given the relatively small costs of cybersecurity
expenditures compared to utilities' overall cost-of-service.
---------------------------------------------------------------------------

    \285\ The Commission also explained that, consistent with Order
No. 679, which implemented FPA section 219, it interpreted the
directive to establish incentive-based, including performance-based,
rate treatments in FPA section 219A to require the Commission to
consider performance-based rates as an option among incentive
ratemaking treatments. Id. P 46 n.41.
    \286\ Id. P 45.
---------------------------------------------------------------------------

b. Comments
    157. No commenter explicitly supports performance-based rates with
respect to cybersecurity investments. EEI, Iowa Utilities Board, and
Ohio Consumers' Counsel all filed comments opposing this approach.\287\
EEI argues that, without clear, industry-wide metrics, a performance-
based program would be difficult to implement.\288\ Ohio Consumers'
Counsel states that setting a performance threshold for advanced
cybersecurity investment and activities is likely to be challenging,
given the rapid pace of development in both the types of cybersecurity
threats experienced and the technological advances used to counter
those threats.\289\ Iowa Utilities Board comments that performance
measurement for cybersecurity investments is difficult because, more
often than not, it would be difficult to pinpoint the root cause of
failure on a particular entity or process when there is a performance
failure.\290\
---------------------------------------------------------------------------

    \287\ EEI Initial Comments at 12-13; Iowa Utilities Board
Initial Comments at 4; Ohio Consumers' Counsel Initial Comments at
14.
    \288\ EEI Initial Comments at 12.
    \289\ Ohio Consumers' Counsel Initial Comments at 14.
    \290\ Iowa Utilities Board Initial Comments at 4.
---------------------------------------------------------------------------

    158. Ohio FEA states that, if the Commission adopts performance-
based rates for cybersecurity incentives, it should neither choose
which expenses to approve nor check whether incurred expenses comply
with the utility's plans but should simply verify whether predetermined
outcomes have been achieved.\291\ Ohio FEA recommends that the
Commission consider developing resources, such as C2M2, to achieve a
performance monitoring tool that will aid in performance-based
rates.\292\
---------------------------------------------------------------------------

    \291\ Ohio FEA Initial Comments at 12.
    \292\ Id. at 12.
---------------------------------------------------------------------------

c. Commission Determination
    159. We interpret the directive to establish incentive-based,
including performance-based, rate treatments in FPA section 219A to
require the Commission to consider performance-based rates as an option
among incentive ratemaking treatments. This interpretation is
consistent with the Commission's finding in Order. No. 679 regarding
the directive to establish incentive-based (including performance-
based) rate treatments for investments in transmission infrastructure
in FPA section 219.\293\ Because of the Congressional directive to
encourage performance-based rates, the Commission signaled its
intention to reevaluate previous Commission policies on performance-
based rate treatments and attempt to offer such incentives in the
cybersecurity context. We recognize that performance-based regulation
could theoretically provide a valuable tool to motivate utilities to
maintain and operate their systems reliably and efficiently.
Performance-based ratemaking can take multiple forms, but ultimately
requires the ability to measure and tie rate treatments to actual
performance (i.e., the number and severity of cybersecurity incidents)
rather than intermediate steps such as specific cybersecurity protocols
or cybersecurity investments that intend to achieve that performance.
---------------------------------------------------------------------------

    \293\ Order No 679, 116 FERC ] 61,057 at P 270.
---------------------------------------------------------------------------

    160. However, after evaluating the comments, we continue to find
that it is difficult to directly observe the success of a cybersecurity
investment. We share the view of commenters that it would be premature
to adopt generic performance-based rate measures at this time. However,
the development of performance-based rate measures may represent a
long-term goal for utilities and the Commission to pursue.

D. Cybersecurity Investment Incentive Implementation

1. Cybersecurity ROE Incentive Duration
a. NOPR Proposal
    161. The Commission proposed to allow a utility granted a
Cybersecurity ROE Incentive to receive that incentive until the
earliest of: (1) the conclusion of the depreciation life of the
underlying asset; (2) five years from when the cybersecurity
investment(s) enter service; \294\ (3) the time that the investment(s)
or activities that serve as the basis of that incentive become
mandatory pursuant to a Reliability Standard approved by the
Commission, or local, State, or Federal law; or (4) the recipient no
longer meets the requirements for receiving the incentive.\295\ The
Commission recognized that incentive-eligible cybersecurity investments
primarily include equipment or system modifications that typically have
short depreciation lives, as opposed to long-lived assets like physical
structures. The Commission believed that most cybersecurity incentives
granted under this rulemaking would remain in effect

until the conclusion of the depreciation life of the underlying asset.
However, for investments with useful lives exceeding five years, the
Commission proposed that the incentive end at the conclusion of five
years from the time that the asset receiving the cybersecurity
incentive entered service, noting that most IT investments feature
useful lives no longer than five years. The Commission preliminarily
found that five years is a reasonable expected life to encourage
utilities to make an investment and to ensure just and reasonable
rates. The Commission also sought comment on whether the proposed
duration should be three years instead of five years.
---------------------------------------------------------------------------

    \294\ For participation in a cybersecurity threat information
sharing program, the ``investment'' would recur annually.
    \295\ NOPR, 180 FERC ] 61,189 at P 46.
---------------------------------------------------------------------------

b. Comments
    162. EEI comments that the five-year depreciation period may be
reasonable, but, if the utility has a cybersecurity asset with a longer
depreciation life, the utility should have the option to make an
argument for a longer incentives period, depending on the investment on
a case-by-case basis.\296\ EEI further comments that, if an incentive
becomes mandatory, it is not clear why it must end automatically. EEI
argues that, for example, if the investment is in year three and then
in year four it becomes a mandatory standard, the utility would lose
the incentive moving forward and that this approach will dampen
potential incentives to do the work to be an early adopter of
promising, qualifying cybersecurity measures.\297\ AEP comments that
the proposed five-year duration is unlikely to drive utilities to
meaningfully reconsider their current and future investment in
cybersecurity.\298\
---------------------------------------------------------------------------

    \296\ EEI Initial Comments at 13.
    \297\ Id. at 14.
    \298\ AEP Initial Comments at 4-5.
---------------------------------------------------------------------------

    163. APPA, California Parties, the Electricity Consumers Resource
Council (ELCON), Ohio Consumers' Counsel, and TAPS state that the
Commission should limit the duration proposal to a maximum of three
years.\299\ California Parties, TAPS, and Ohio Consumers' Counsel argue
that setting the limit at three years better aligns with the fast-
evolving nature of cybersecurity technology, and that consumers should
not have to pay for technology that has become obsolete.\300\ APPA
comments that, where an asset has a useful life of no more than five
years, a three-year Cybersecurity ROE Incentive would apply to a large
portion, and potentially all, of the asset's useful life.\301\ APPA
states that the value of the Cybersecurity ROE Incentive to a utility
would decline over time as the underlying asset depreciates and reduces
the rate base to which the ROE adder is applied.\302\
---------------------------------------------------------------------------

    \299\ APPA Initial Comments at 5; California Parties Initial
Comments at 22; ELCON Initial Comments at 4; Ohio Consumers' Counsel
Initial Comments at 15; TAPS Initial Comments at 18-19.
    \300\ California State Parties Initial Comments at 25; Ohio
Consumers' Counsel Initial Comments at 15; TAPS Initial Comments at
19.
    \301\ APPA Initial Comments at 16.
    \302\ Id. at 16.
---------------------------------------------------------------------------

c. Commission Determination
    164. As discussed in section III.C.1.c., we do not adopt the NOPR's
proposed Cybersecurity ROE Incentive. Consequently, we need not address
the duration of this incentive.
2. Cybersecurity Regulatory Asset Incentive Duration and Amortization
Period
a. NOPR Proposal
    165. The Commission proposed to specify that a utility granted the
Cybersecurity Regulatory Asset Incentive must amortize the regulatory
asset over five years.\303\ The Commission stated that this may reflect
the generally short-lived nature of cybersecurity activities and
corresponds to the depreciation rates for investments described
above.\304\ The Commission observed that this period generally relates
to the expected useful life and associated cost-of-service amortization
period of cybersecurity investments.
---------------------------------------------------------------------------

    \303\ As noted above, the cybersecurity investment for
participation in a cybersecurity threat information sharing program
would recur annually.
    \304\ NOPR, 180 FERC ] 61,189 at P 47.
---------------------------------------------------------------------------

    166. The Commission also proposed to specify that a utility granted
the Cybersecurity Regulatory Asset Incentive may defer eligible
expenses for up to five years from the date of Commission approval of
the incentive.\305\ Under this provision, the Commission proposed that
eligible expenses incurred for five years could be added to the
regulatory asset that is allowed in rate base and amortized over five
subsequent years.\306\ The Commission preliminarily found that this
limit would be appropriate, given the potentially indefinite nature of
certain expenses. The Commission stated that such a limit would also
reflect that cybersecurity risks and solutions evolve over time and
matches the proposed five-year maximum duration of the Cybersecurity
ROE Incentive. The Commission preliminarily found that a five-year
limit appropriately balances the goal of providing an incentive of a
sufficient size to encourage utilities to make eligible improvements in
their cybersecurity posture with the requirement to protect ratepayers.
---------------------------------------------------------------------------

    \305\ Id. P 48.
    \306\ The Commission proposed that, in their FPA section 205
filings, incentive recipients must include notes to their formula
rates specifying the Commission order(s) which approved the
incentive and stating that the associated Cybersecurity Regulatory
Asset Incentive must terminate in the earlier of: (1) five years
from the date of the later of the Commission approving the incentive
or the expense being incurred; or (2) the cybersecurity investment
becoming mandatory.
---------------------------------------------------------------------------

    167. However, the Commission proposed to make an exception to this
sunsetting provision for eligible cybersecurity threat information
sharing programs.\307\ The Commission noted that FPA section 219A(c)(2)
directs the Commission to provide incentives for participation in
cybersecurity threat information sharing programs. The Commission
preliminarily found that participation in such cybersecurity threat
information sharing programs, which provide participants with ongoing
updates about active cybersecurity threats and are therefore distinct
from other cybersecurity investments that may become obsolete with the
passage of time, warrants a different incentive treatment than other
investments. Consequently, the Commission proposed that utilities be
able to continue deferring these ongoing expenses and including them in
their rate base for each annual tranche of expenses, for as long as:
(1) the utility continues incurring costs for its participation in the
program; and (2) the program remains eligible for incentives.
---------------------------------------------------------------------------

    \307\ NOPR, 180 FERC ] 61,189 at P 49.
---------------------------------------------------------------------------

b. Comments
    168. EEI supports the NOPR proposal to make an exception to the
sunsetting provision for eligible cybersecurity threat information
sharing programs on the basis that they are distinct from discrete
cybersecurity investments that may become obsolete with the passage of
time.\308\ EEI comments that sharing information about the nature of
threats can help electric utilities react to and mitigate the
threat.\309\
---------------------------------------------------------------------------

    \308\ EEI Initial Comments at 14.
    \309\ Id. at 14.
---------------------------------------------------------------------------

    169. EEI requests clarification that the amortization period would
be up to five years, but that five years is not the only duration
permissible for amortization.\310\
---------------------------------------------------------------------------

    \310\ Id. at 14.
---------------------------------------------------------------------------

    170. TAPS agrees with the Commission's preliminary finding that the
five-year limit balances the goals of ratepayer protection with
inducing the desired investment.\311\ However, TAPS argues that the
NOPR unjustifiably proposed to depart from that balance

with regard to expenses incurred for eligible cybersecurity threat
information sharing programs by allowing a perpetual incentive on those
investments.\312\ TAPS argues that the Commission should not adopt such
an exception for cybersecurity threat information sharing programs,
because it gives no consideration of the requirement to protect
ratepayers.\313\ TAPS states that the NOPR's distinction from other
discrete cybersecurity investments that may become obsolete with the
passage of time does not support granting a perpetual incentive for
cybersecurity threat information sharing programs.\314\ TAPS further
argues that the fact that participants are provided with ongoing
updates after joining such programs is a recurring benefit that likely
increases retention, even absent any incentive.\315\
---------------------------------------------------------------------------

    \311\ TAPS Initial Comments at 20-21.
    \312\ Id. at 21.
    \313\ Id. at 21.
    \314\ Id. at 22.
    \315\ Id. at 22.
---------------------------------------------------------------------------

    171. California Parties also oppose the NOPR's exception to the
sunsetting provision for eligible cybersecurity threat information
sharing programs.\316\ California Parties state that, once a utility
has elected to participate in CRISP and has paid the requisite start-up
costs, there is no longer a purpose served by incentive treatment,
given that the utility is able to readily recover all ongoing costs of
participation (along with the start-up costs) in transmission
rates.\317\ California Parties argue that, to provide incentives in
this circumstance--where they are simply not needed to induce prudent
spending on an annual subscription to CRISP and associated staff time--
would result in unjust and unreasonable rates.\318\
---------------------------------------------------------------------------

    \316\ California Parties Initial Comments at 27.
    \317\ Id. at 27.
    \318\ Id. at 27.
---------------------------------------------------------------------------

c. Commission Determination
    172. We adopt the NOPR's proposal to add Sec.  35.48(g)(1) to the
Commission's regulations, with one modification. As suggested by EEI,
we will modify the NOPR proposal to allow, at the request of the
utility, the Cybersecurity Regulatory Asset Incentive duration to be up
to five years. This revision provides flexibility to requesting
utilities while maintaining ratepayer protections. A utility granted
the Cybersecurity Regulatory Asset Incentive must amortize the
regulatory asset for up to five years. Additionally, a utility granted
the Cybersecurity Regulatory Asset Incentive may defer eligible
expenses for up to five years from the date of Commission approval of
the incentive. Consistent with the NOPR proposal, we find that a five-
year amortization period balances the Commission's goals of ratepayer
protection and providing an appropriate incentive to encourage
utilities to improve their cybersecurity posture. To clarify,
incentive-eligible, cybersecurity expenses for each of the five years
may be included in rate base and amortized for up to five years,
essentially creating five tranches of cybersecurity expenses. We also
clarify that if and when cybersecurity measures become mandatory,
utilities will cease receiving the Cybersecurity Regulatory Asset
Incentive for taking such measures.\319\ No additional expenses will be
converted to regulatory assets and the unamortized portions of
regulatory assets must be incurred as expenses in the year when they
were converted back to expenses and immediately removed from rate base.
---------------------------------------------------------------------------

    \319\ See Cal. Pub. Util. Comm'n v. FERC, 879 F.3d 966 (9th Cir.
2018).
---------------------------------------------------------------------------

    173. We add Sec.  35.48(g)(2) to the Commission's regulations to
provide an exception to the five-year duration limit to the incentive-
based rate treatment of cybersecurity investments made to participate
in a cybersecurity threat information sharing program. We find that the
duration exception for participation in eligible cybersecurity threat
information sharing programs as proposed in the NOPR is appropriate. As
discussed in the body of this rule, the Congressional mandate to
incentivize participation indicates that all participants should be
eligible to seek cybersecurity incentives for their participation in
eligible programs. Therefore, we decline to remove the exception to the
sunsetting provision for participation in an eligible cybersecurity
threat sharing program.
3. Filing Process
a. NOPR Proposal
    174. The Commission proposed to require a utility's request for one
or more incentive-based rate treatments to be made in a filing pursuant
to FPA section 205. As proposed in the NOPR, such a request must
include a detailed explanation of how the utility plans to implement
one or both of the proposed incentive approaches and the requested rate
treatment.\320\ The Commission proposed to require utilities to provide
detail on the expenditures for which they seek incentives and show how
the cybersecurity-related expenditures meet the eligibility
requirements, as described in more detail below.
---------------------------------------------------------------------------

    \320\ NOPR, 180 FERC ] 61,189 at P 50.
---------------------------------------------------------------------------

    175. In addition, the Commission proposed that a utility seeking
one or more incentive-based rate treatments must receive Commission
approval prior to implementing any incentive in its rate on file with
the Commission. The Commission stated that, in order to effectuate an
incentive in rates, utilities would need to propose in their FPA
section 205 filing conforming revisions to their formula rates to
reflect incentive rate treatment granted pursuant to these proposed
regulations. The Commission explained that utilities with stated rates
may file under FPA section 205 to seek incentives as part of a larger
rate case or make a request for single issue ratemaking, which the
Commission will evaluate on a case-by-case basis to ensure that the
rate, inclusive of the incentive, is just and reasonable and not unduly
discriminatory or preferential.\321\
---------------------------------------------------------------------------

    \321\ Id. P 51 & n.47.
---------------------------------------------------------------------------

    176. The Commission proposed that filings under the PQ List
approach must provide evidence that the utility has made one or more
pre-qualified cybersecurity expenditures and otherwise complies with
all appropriate requirements.\322\
---------------------------------------------------------------------------

    \322\ Id. P 52.
---------------------------------------------------------------------------

    177. The Commission also proposed that a utility requesting the
Cybersecurity ROE Incentive must provide the anticipated cost of the
capital investment and the identity of the rate schedule(s) on file
with the Commission under which it will recover the increased ROE.\323\
The Commission alternatively proposed that a utility requesting the
Cybersecurity Regulatory Asset Incentive must provide a description of
the covered expense(s), including whether the expense(s) are associated
with the third-party provision of hardware, software, and computing
network services or incurred for training to implement network analysis
and monitoring programs, as well as an estimate of the cost of such
expense(s) and when the cost is expected to be incurred.
---------------------------------------------------------------------------

    \323\ Id. P 53.
---------------------------------------------------------------------------

    178. The Commission preliminarily found that the same cybersecurity
investment should not be eligible for both the Cybersecurity ROE
Incentive and the Cybersecurity Regulatory Asset Incentive. Given that
regulatory asset treatment may be approved for costs that are normally
treated as expenses (i.e., as regulatory assets), the Commission
preliminarily found that costs that are allowed to be deferred as a
regulatory asset should be included in rate base for determination of
the base return but not for the additional return

associated with the 200-basis point ROE adder.\324\
---------------------------------------------------------------------------

    \324\ Id. P 38.
---------------------------------------------------------------------------

b. Comments
    179. Ohio Consumers' Counsel requests that the Commission require
any incentive application (whether an application for incentives for
advanced technologies and actions on the pre-qualification list or for
incentives that are not included on that list) to be made in a FPA
section 205 filing.\325\ Ohio Consumers' Counsel further requests that
the Commission require that both types of applications explicitly
identify in which accounts the utility will book the costs associated
with the investment, expense or action.\326\ Ohio Consumers' Counsel
comments that such a requirement is needed to ensure transparency and
proper rate treatment for these investments.\327\
---------------------------------------------------------------------------

    \325\ Ohio Consumers' Counsel Initial Comments at 9.
    \326\ Id. at 9-10.
    \327\ Id. at 10.
---------------------------------------------------------------------------

    180. California Parties ask the Commission to clarify the incentive
application procedures to ensure that stakeholders have adequate time
and information to meaningfully review and comment on incentive
requests.\328\ California Parties argue that the usual filing
procedures under FPA section 205 are not sufficient because they
neither provide ample time for review, given the more complex nature of
cybersecurity incentive applications, nor do the procedures ensure the
development of an adequate factual record, especially given the CEII
considerations.\329\ In support, California Parties state that the
filing procedures under FPA section 205 provide only 21 days for an
interested party to intervene and comment and do not ensure the
opportunity for discovery or evidentiary hearings.\330\ California
Parties request that the Commission make clear that all cybersecurity
incentive applications will be presumed to raise issues of material
fact and will thus be subject to an evidentiary hearing with an
opportunity for discovery.\331\ California Parties aver that
evidentiary hearings and discovery would provide a critical measure of
transparency regarding the use of ratepayer funds, provided appropriate
safeguards are in place.\332\
---------------------------------------------------------------------------

    \328\ California Parties Initial Comments at 30.
    \329\ Id. at 30.
    \330\ Id. at 30.
    \331\ Id. at 31.
    \332\ Id. at 31.
---------------------------------------------------------------------------

    181. NRECA seeks additional detail on the NOPR's proposed filing
process.\333\ Specifically, NRECA requests that the Commission propose
language addressing applications under the case-by-case approach.\334\
NRECA also asks the Commission to describe the anticipated composition
of teams responsible for reviewing and evaluating requests under the
proposed new provisions.\335\ NRECA states that, given the wide-ranging
implications of granting cybersecurity incentives, the reviewing team
should include staff with diverse backgrounds, including electrical
engineers who understand the structure of the transmission and
generations assets that may be affected by the proposed cybersecurity
investment, system or computer science engineers who understand the
nature of the proposed investments, and analysts with ratemaking
experience who can balance the increased benefits of the proposed
investment against the cost to the ratepayers.\336\
---------------------------------------------------------------------------

    \333\ NRECA Initial Comments at 10-12.
    \334\ Id. at 11.
    \335\ Id. at 11.
    \336\ Id. at 11-12.
---------------------------------------------------------------------------

    182. MISO Transmission Owners caution that, while the inclusion of
cybersecurity threat information sharing programs on the PQ List will
provide certainty, efficiency, and transparency for utilities seeking
an incentive, public disclosure through the filing process could put
utilities at risk.\337\ MISO Transmission Owners recommend that the
Commission adopt filing procedures that would protect the
confidentiality of utilities requesting incentives, including the use
of a public cover sheet disclosing what incentives are being applied
for with the remainder of the application being confidential.\338\ In
contrast, NRECA acknowledges the need for utilities to submit certain
information under CEII filing regulations but warns that the more
information filing utilities are able to hide from the public, the
greater the burden on interested parties.\339\ NRECA cautions that the
consolidation of incentive applications containing sensitive
information may increase the overall risk to the bulk electric
system.\340\
---------------------------------------------------------------------------

    \337\ MISO Transmission Owners Initial Comments at 7.
    \338\ Id.
    \339\ NRECA Initial Comments at 13.
    \340\ Id. at 13.
---------------------------------------------------------------------------

c. Commission Determination
    183. We adopt the NOPR's proposal and add Sec.  35.48(h) to the
Commission's regulations, which specifies the details required in
applications to the Commission to receive incentive-based rate
treatment for cybersecurity investments. We clarify that utilities may
request Commission approval of incentives for cybersecurity investments
pursuant to FPA section 219A by filing an FPA section 205 filing or by
seeking a ruling on eligibility by filing a petition for declaratory
order followed-up by an FPA section 205 filing. Utilities must propose
to revise their rates to reflect such incentives pursuant to FPA
section 205. Pursuant to FPA section 219A(f), Sec.  35.48(h) permits
utilities to seek cybersecurity incentives either as part of a larger
rate case or make a request for single issue ratemaking.\341\
---------------------------------------------------------------------------

    \341\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 952
(to be codified at 16 U.S.C. 824s-1(f)).
---------------------------------------------------------------------------

    184. With regard to Ohio Consumers' Counsel's suggestion that the
Commission require any incentive application (whether an application
for incentives for Advanced Cybersecurity Technologies and actions on
the PQ List or for incentives that are not included on that list) to be
made in a FPA section 205 filing, we agree that an FPA section 205
filing is necessary for any incentives to be effectuated in utility
rates. However, consistent with the Commission's precedent with respect
to transmission incentives, we will allow utilities to seek declaratory
orders finding expenditures to be eligible for incentives prior to
making FPA section 205 filings to implement incentives in rates. A
request for a declaratory order must include all necessary information
for the Commission to determine whether the investment merits an
incentive. The FPA section 205 filing necessary to add incentive-based
rate treatment to a utility's rate on file with the Commission, whether
filed in conjunction with a petition for declaratory order or on its
own, must provide information required for the Commission to determine
that the rate inclusive of the incentives is just and reasonable and
not unduly discriminatory or preferential.\342\
---------------------------------------------------------------------------

    \342\ 18 CFR pt. 35.
---------------------------------------------------------------------------

    185. The filing process is similar for incentives requested for
cybersecurity investments that are on the PQ List and case-by-case
requests. The distinction is that requests for incentives for
cybersecurity investments that are on the PQ List have the rebuttable
presumption that the items on the PQ List satisfy the eligibility
criteria, i.e., materially improving cybersecurity posture and not
already being mandatory. By contrast, applicants under a case-by-case
approach must provide a detailed description of how the cybersecurity
investments will satisfy the eligibility criteria and thereby
materially improve the cybersecurity posture for their utility. To make
this demonstration, in addition to describing

the cybersecurity investments, applicants should: (1) describe their
prevailing cybersecurity posture including existing equipment,
processes, and ongoing expenses; and (2) describe how the cybersecurity
investment for which an incentive is sought would elevate the utility's
cybersecurity posture. The application should include evidence
sufficient to demonstrate that the cybersecurity investment(s) would be
for activities that are consistent with the discussion in section
III.B. regarding the PQ List and case-by-case approaches. We also
clarify that, for incentive requests either for PQ List items or on a
case-by-case basis, utilities must include in their transmittal letter
an attestation that, to their knowledge, the cybersecurity investments
are not mandatory, as described in section III.A.3. above.
Additionally, for the Cybersecurity Regulatory Asset Incentive, the
transmittal letter must include an attestation that the utility has not
already been undertaking materially the same cybersecurity expenses for
more than three months (with the exception of participation in
cybersecurity threat information sharing programs).\343\ As described
in III.C.2. only new types of cybersecurity investments, and not
materially similar ones to existing expenses, will be eligible for
incentive-based rate treatment.
---------------------------------------------------------------------------

    \343\ For ongoing cybersecurity investments made to comply with
approved Reliability Standards, the three-month period begins on the
date that the Commission's approval of the Reliability Standard
becomes effective. For approvals that the Commission issues by
order, the effective date is the date of the order. For approvals
that the Commission issues by rulemaking, the effective date occurs
on a specified date that occurs after the later of Congress
receiving notice from the Commission or the final rule is published
in the Federal Register.
---------------------------------------------------------------------------

    186. As described in Sec.  35.48(h), requests for the Cybersecurity
Regulatory Asset Incentive must provide: (1) a description of the
relevant cybersecurity expenses; (2) estimates of the costs of
cybersecurity expenses; (3) a description of when the cybersecurity
expenses are expected to be incurred; and (4) an attestation that the
utility's cybersecurity expenses are new, i.e., the utility has not
already been undertaking materially the same cybersecurity expenses for
more than three months prior to the date of filing its request with the
Commission. Descriptions of expenses should include details such as
whether they are conducted by utility employees or third parties and
whether they are for training or the direct carrying out of
cybersecurity tasks. This last requirement seeks to ensure that
cybersecurity incentives encourage utilities to improve their
cybersecurity posture rather than provide a return on expenses that the
utility is already undertaking. Incentive-eligible expenses should be
meaningfully distinct from past ones and not only contain small
variations or incremental modifications from existing expenses.
    187. Consistent with the Commission's implementation of
transmission incentives under FPA section 219, interested parties will
have a 21-day comment period, unless otherwise provided by the
Commission.\344\ We find that California Parties have not justified
departing from the Commission's comment period convention. Doing so
could impede the timeliness of the Commission's evaluation of
cybersecurity incentives. Furthermore, we will not presume that every
request for cybersecurity incentives will have issues of material fact
requiring hearing and settlement judge procedures. Such a presumption
would also constitute an unjustified departure from Commission
incentive precedent under FPA section 219 and may unnecessarily delay
the incentive-based rate treatment of cybersecurity investments as well
as the utility's underlying cybersecurity investments.
---------------------------------------------------------------------------

    \344\ 18 CFR 35.8.
---------------------------------------------------------------------------

    188. In response to Ohio Consumers' Council suggested requirement
that utilities identify the accounts that cybersecurity investment will
be booked in, as described in section III.C.2, pursuant to our existing
regulations, any utility that receives an incentive must maintain
sufficient records to support the distinction of any investments that
are afforded incentive-based rate treatment.
    189. We will not, as NRECA suggests, describe the anticipated
composition of Commission staff responsible for reviewing and
evaluating requests under the proposed new provisions. Such description
is neither necessary nor consistent with Commission procedures.
    190. Consequently, for a given cybersecurity investment, utilities
will be able to receive a single incentive-based rate treatment, as
discussed in section III.B., for each voluntary cybersecurity
investment that the utility makes. Utilities must specify which
incentive they seek in their filings with the Commission.
    191. We note that Sec.  35.48(j) to the Commission's regulations
declares that utilities may request CEII treatment pursuant to Sec.
35.48(k) to the Commission's regulations for the portions of their
cybersecurity incentive-based rate filings that contains CEII. This is
consistent with Sec.  388.113 of the Commission's regulations.\345\ In
addition, FPA section 219A(g) declares that Advanced Cybersecurity
Technology Information provided to the Commission under FPA 219A(b),
(c), or (f) ``shall be considered to be Critical Electric
Infrastructure Information under [FPA] section 215A.'' \346\
---------------------------------------------------------------------------

    \345\ 18 CFR 388.113.
    \346\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 951
(to be codified at 16 U.S.C. 824s-1(g)).
---------------------------------------------------------------------------

4. Reporting Requirements
a. NOPR Proposal
    192. In order to ensure that a utility receiving incentive rate
treatment has implemented the requirements of the incentive and to
ensure that it continues to adhere to the requirements, the Commission
proposed to require utilities to submit informational reports to the
Commission for the duration of the incentive.\347\
---------------------------------------------------------------------------

    \347\ NOPR, 180 FERC ] 61,189 at P 54.
---------------------------------------------------------------------------

    193. The Commission also proposed that a utility that has received
cybersecurity incentives under this section must make an annual
informational filing by June 1, provided that the utility has received
Commission-approval for the incentive at least 60 days prior to June 1
of that year.\348\ Utilities that receive Commission-approval for an
incentive later than 60 days prior to June 1 would be required to
submit an annual informational filing beginning on June 1 of the
following year. The Commission proposed that the annual filing should
detail the specific investments, if any, as of that date, that were
made pursuant to the Commission's approval and the corresponding FERC
account for which expenditures are booked. For recipients of the
Cybersecurity ROE Incentive, the Commission proposed that each annual
informational filing should describe the parts of its network that it
upgraded in addition to the nature and cost of the various investments.
For recipients of the Cybersecurity Regulatory Asset Incentive, the
Commission proposed that each annual informational filing should
describe such expenses in sufficient detail to demonstrate that such
expenses are specifically related to the eligible cybersecurity
investment underlying the incentives and not for ongoing services
including system maintenance, surveillance, and other labor costs.
---------------------------------------------------------------------------

    \348\ Id. P 55.
---------------------------------------------------------------------------

    194. The Commission noted that it could also conduct periodic
verification to assess cybersecurity investments and expenses for which
it has approved

incentives.\349\ The Commission could perform such verifications
through multiple means (i.e., directing further informational filings,
audits, etc.). The Commission stated that the annual informational
filings would inform the Commission on how and when any additional
verification is warranted.
---------------------------------------------------------------------------

    \349\ Id. P 56.
---------------------------------------------------------------------------

b. Comments
    195. Ohio Consumers' Counsel supports the NOPR's proposal and
recommends that the Commission and consumers must both be able to
verify that the investments are being made and that the intended
benefits are being received.\350\
---------------------------------------------------------------------------

    \350\ Ohio Consumers' Counsel Initial Comments at 16.
---------------------------------------------------------------------------

    196. Several commenters ask for the Commission to require
additional information beyond the proposed reporting requirements.
NRECA requests that the Commission require that the annual
informational filings include any changes to the categorization of any
incentivized enhancements and affirmatively state that the previously
incentivized enhancement remains valid.\351\ NRECA states that this
modification will address the burden placed on ratepayers to review and
analyze the information provided to ensure the accuracy of formulas
applying different ROEs, especially where certain of those ROEs are
capped.\352\ NRECA also asks that the Commission consider issuing
responses confirming the continued applicability of incentive rate
treatment in response to the annual informational filings.\353\ Ohio
FEA recommends that verification methods should be established that go
beyond the annual information filings proposed by the NOPR to ensure
that cybersecurity benefits are realized and that double recovery of
incentives is avoided.\354\ NRECA also recommends that the Commission
establish a process to confirm whether a utility's cybersecurity
investment had the security effects described.\355\
---------------------------------------------------------------------------

    \351\ NRECA Initial Comments at 12.
    \352\ Id. at 12.
    \353\ Id. at 12.
    \354\ Ohio FEA Initial Comments at 13.
    \355\ NRECA Initial Comments at 9.
---------------------------------------------------------------------------

    197. California Parties urge the Commission to require utilities
awarded cybersecurity incentives to submit aggregated data and,
consistent with the Commission's CEII regulations, provide vetted State
officials access to it.\356\ California Parties argue that the
provision of such data will, in turn, enable the relevant State
officials to improve the cybersecurity protection of utility assets in
their respective states.\357\
---------------------------------------------------------------------------

    \356\ California Parties Initial Comments at 34.
    \357\ Id. at 34-35.
---------------------------------------------------------------------------

    198. While not opposed to the NOPR proposal, EEI states that the
Commission should allow the annual reports to be filed under the CEII
regulations because the information the Commission seeks, while
innocuous on its own, could be coupled with other information and used
by those seeking to attack the reliability of U.S. energy
infrastructure.\358\ EEI states that, given the sensitivity of
information filed as part of an annual report, electric companies would
need assurances regarding how the various intervenor/third-party
recipients of CEII would comply with sensitive data and information
protection requirements, the obligation to destroy CEII when requested
to do so, the prohibition on sharing CEII, and immediate reporting of
unauthorized access of CEII.\359\
---------------------------------------------------------------------------

    \358\ EEI Initial Comments at 16.
    \359\ Id. at 17.
---------------------------------------------------------------------------

c. Commission Determination
    199. Consistent with the NOPR, in order to ensure that a utility
receiving incentive-based rate treatment has implemented and continues
to adhere to the requirements of the incentive, we require utilities to
submit informational reports to the Commission for the duration of the
cybersecurity incentive, pursuant to Sec.  35.48(i), which we are
adding to the Commission's regulations. We continue to find that
cybersecurity investments, unlike many others, may not otherwise be
observable and verifiable by other parties. Consistent with the
comments of Ohio Consumers' Counsel and California Parties, this
requirement should provide State commissions and other stakeholders
enhanced visibility into the cybersecurity investments that utilities
are making for which they receive incentives.
    200. Consistent with the NOPR, a utility that has received
cybersecurity incentives under this section must make an annual
informational filing by June 1 of that calendar year, provided that the
utility has received Commission-approval for the incentive at least 60
days prior to June 1 of that year. Utilities that receive Commission-
approval for an incentive within 60 days before June 1 must submit an
annual informational filing beginning on June 1 of the following
year.\360\ The annual filing must detail the specific investments, if
any, as of that date, that were made pursuant to the Commission's
approval and the corresponding FERC account for which the cybersecurity
investments are booked. For recipients of the Cybersecurity Regulatory
Asset Incentive, annual informational filings should describe expenses
in sufficient detail to demonstrate that such expenses specifically
relate to the eligible cybersecurity investment and not to ongoing
services including system maintenance, surveillance, and other labor
costs that are materially the same as those that existed prior to the
incentive request. Additionally, consistent with NRECA's comments,
annual informational filings must specify any material changes in the
nature of such expenses from prior filings. Unlike capital investments,
ongoing expenses could potentially change in nature over time, and this
provision ensures that the incentives in utility rates correspond to
the precise expenses for which the Commission approved incentives.
---------------------------------------------------------------------------

    \360\ If a utility first receives Commission-approval for the
incentive on April 1 or later, its initial annual informational
filing would be due on June 1 of the following year.
---------------------------------------------------------------------------

    201. We will not, as requested by NRECA, include a requirement for
the Commission to issue responses confirming the continued
applicability of incentive rate treatment in response to the annual
informational filings. We do not find that such affirmative
confirmation is necessary to ensure that incentives continue to be just
and reasonable.
    202. We also decline to establish a process to confirm whether a
utility's cybersecurity investment had the security effects described
as recommended by NRECA.\361\ The annual informational filings will
enable the Commission and interested parties to confirm that utilities
have made the cybersecurity investments for which they receive
incentives. Establishing a process to review the efficacy of each
cybersecurity investment would create a substantial regulatory burden
on utilities and other parties, including the Commission. Furthermore,
measuring the ultimate effect of specific cybersecurity investments may
be difficult given that security defenses can act as a deterrence to
cyberattack and therefore it is impossible to know what cyberattacks
have been prevented.
---------------------------------------------------------------------------

    \361\ NRECA Initial Comments at 9.
---------------------------------------------------------------------------

    203. We note that Sec.  35.48(j) to the Commission's regulations
declares that utilities may request CEII treatment pursuant to Sec.
35.48(i) to the Commission's regulations for the portions of their
cybersecurity incentive-based rate informational reports that contain
CEII. This is consistent with Sec.  388.113 of the

Commission's regulations.\362\ In addition, FPA section 219A(g)
declares that Advanced Cybersecurity Technology Information provided to
the Commission under FPA 219A(b), (c), or (f) ``shall be considered to
be Critical Electric Infrastructure Information under [FPA] section
215A.'' \363\
---------------------------------------------------------------------------

    \362\ 18 CFR 388.113.
    \363\ IIJA, Public Law 117-58, section 40123, 135 Stat. at 951
(to be codified at 16 U.S.C. 824s-1(g)).
---------------------------------------------------------------------------

E. Other Issues

1. Comments
    204. INGAA and the International Pipeline Resilience Organization
(IPRO) support the Commission's efforts to provide cybersecurity
incentives to electric utilities but argue that rate-based incentives
should also be available to owners and operators of interstate natural
gas pipelines under the Commission's authority.\364\ Both commenters
assert that, due to the highly interconnected nature of the electric
and gas industries and the similarities in threats faced by both
industries, the Commission is overlooking a security threat by solely
focusing on incentives for electric utilities.\365\ IPRO argues that
the Commission has the requisite authority under the NGA and the
Interstate Commerce Act (ICA) to offer incentives to the oil and gas
industry.\366\ In contrast, California Parties assert that, because the
NOPR does not cite the NGA or ICA, the Commission cannot include
incentives for pipeline owners and operators in the final rule.\367\
---------------------------------------------------------------------------

    \364\ INGAA Initial Comments at 2; IPRO Initial Comments at 2-3.
    \365\ INGAA Initial Comments at 2; IPRO Initial Comments at 2-3.
    \366\ IPRO Initial Comments at 9-10.
    \367\ California Parties Reply Comments at 14.
---------------------------------------------------------------------------

    205. EPSA urges the Commission to prevent cross-subsidization among
vertically integrated entities. EPSA avers that, while these companies
may have separate legal entities for their transmission and generation
operations, cybersecurity programs are often administered as a shared
service. EPSA argues that the Commission must ensure that any entities
to which it extends incentives on the transmission side are not cross-
subsidizing cybersecurity operations for their generation arms.\368\
---------------------------------------------------------------------------

    \368\ EPSA Initial Comments at 9.
---------------------------------------------------------------------------

2. Commission Determination
    206. We will not, as IPRO advocates, extend incentives to natural
gas pipelines and oil pipelines in this proceeding. This rulemaking
effectuates Congress' requirement that the Commission develop
cybersecurity incentives for utilities pursuant to FPA section 219A. As
noted by California Parties, incentives under the NGA and the ICA are
beyond the scope of this proceeding. We also note that the application
of longstanding cost-of-service cost-allocation practices to
enterprise-wide costs, described in sections III.C.1 and III.C.2 above,
will address EPSA's cross-subsidization concerns.

IV. Information Collection Statement

    207. The information collection requirements contained in this
final rule are subject to review by the Office of Management and Budget
(OMB) under the Paperwork Reduction Act of 1995 at 44 U.S.C. 3507(d).
OMB's regulations require approval of certain information collection
requirements imposed by agency rules.\369\ Upon approval of a
collection of information, OMB will assign an OMB control number and
expiration date. Respondents subject to the filing requirements of this
proposed rule will not be penalized for failing to respond to this
collection of information unless the collection of information displays
a valid OMB Control Number. This final rule establishes the
Commission's regulations with respect to the implementation of FPA
section 219A.\370\
---------------------------------------------------------------------------

    \369\ 5 CFR 1320.11.
    \370\ Public Law 117-55, 135 Stat. 951 (2021) (to be codified at
16 U.S.C. 824s-1).
---------------------------------------------------------------------------

    208. Interested persons may obtain information on the reporting
requirements by contacting Ellen Brown, Office of the Executive
Director, Federal Energy Regulatory Commission, 888 First Street NE,
Washington, DC 20426 via email ([email protected]) or telephone
(202) 502-8663).
    209. The Commission solicited comments on the NOPR and the
collection of information in that NOPR.
    Title: FERC-725B, Incentives for Advanced Cybersecurity Investment.
    Action: Proposed revision of FERC-725B.
    OMB Control No.: 1902-0248.
    Respondents for this Rulemaking: Public utilities and non-public
utilities that have or will have a rate on file with the Commission.
    Frequency of Information Collection:
    On occasion: Voluntary filings seeking incentive-based rate
treatment for cybersecurity expenditures; and
    Annually: An informational filing on June 1 of each year, required
of entities that have been granted and are receiving incentive-based
rate treatment for cybersecurity expenditures.
    Abstract: The final rule provides that a utility may seek
incentive-based rate treatment for cybersecurity investments by making
a rate filing in accordance with section 205 of the FPA. The final rule
states that one approach the Commission may use in evaluating such a
filing is to consider whether prospective cybersecurity investments
would match one of the types of investments listed at proposed 18 CFR
35.48(d). The final rule refers to this list of pre-qualified
expenditures that are eligible for incentives as the PQ List. Any
cybersecurity expenditure that is on the PQ List is entitled to a
rebuttable presumption of eligibility for an incentive.
    210. The final rule also discusses a different approach, in which a
utility's cybersecurity expenditure would be evaluated on a case-by-
case basis to determine if it is eligible for an incentive. Under that
approach, the utility would need to demonstrate that the prospective
investment is voluntary and would materially improve cybersecurity
through either an investment in Advanced Cybersecurity Technology or
participation in cybersecurity threat information sharing program.
Under either approach, the utility would need to demonstrate that its
rate, inclusive of the incentive, is just and reasonable and not unduly
discriminatory or preferential.
    211. The final rule also provides that a utility that is granted
incentive-based rate treatment must submit an annual informational
filing to the Commission by June 1 of each year, provided that the
utility has received Commission approval of the incentive at least 60
days prior to June 1 of that year. Utilities that receive Commission
approval of an incentive later than 60 days prior to June 1 would be
required to submit an annual informational filing beginning on June 1
of the following year. The informational filing must describe the
specific investments, if any, as of that date, that were made pursuant
to the Commission's approval and the corresponding FERC account for
which expenditures are booked. For incentives where the Commission
allows deferral of expenses, annual informational filings should
describe such expenses in sufficient detail to demonstrate that such
expenses are specifically related to the cybersecurity investment for
which the incentive was granted, and not for ongoing services including
system maintenance, surveillance, and other labor costs.
    Necessity of Information: Required to obtain or retain benefits.
    Internal Review: The Commission has reviewed the changes and has
determined that such changes are necessary. These requirements conform
to the Commission's need for efficient

information collection, communication, and management within the energy
industry. The Commission has specific, objective support for the burden
estimates associated with the information collection requirements.
    212. The NERC Compliance Registry, as of August 5, 2022, identifies
approximately 1,669 utilities, both public and non-public, in the U.S.
that would be eligible for this proposed incentive and rate treatment.
The Commission estimates that the NOPR may affect the burden \371\ and
cost \372\ as follows:
---------------------------------------------------------------------------

    \371\ ``Burden'' is the total time, effort, or financial
resources expended by persons to generate, maintain, retain, or
disclose or provide information to or for a Federal agency. For
further explanation of what is included in the information
collection burden, refer to 5 CFR 1320.3.
    \372\ Commission staff estimates that respondents' hourly wages
(including benefits) are comparable to those of FERC employees in
Fiscal Year 2022. Therefore, the hourly cost used in this analysis
is $91 and $188,992 annually.

                                               FERC-725B--Changes in Final Rule in Docket No. RM22-19-000
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                        D.  Annual
                                                        C.  Annual       estimated
                                       B.  Number of     estimated       number of       E.  Average burden       F.  Total  estimated  burden hours &
      A.  Area of  modification         respondents      number of       responses     hours & cost  ($) per     total  estimated cost  ($)(Column D x
                                                       responses per    (Column B x           response                         Column E)
                                                        respondent       Column C)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Voluntary filing seeking incentive                50               1              50  80 hours; $7,280.......  4,000 hours; $364,000
 rate treatment for cybersecurity
 investment. 18 CFR 35.48(b).
Annual informational filing required              50               1              50  40 hours; $3,640.......  2,000 hours; $182,000
 where Commission has granted
 incentive rate treatment. 18 CFR
 35.48(h).
                                     -------------------------------------------------------------------------------------------------------------------
    Totals..........................  ..............  ..............  ..............  .......................  6,000 hours; $546,000
--------------------------------------------------------------------------------------------------------------------------------------------------------

V. Environmental Analysis

    213. The Commission is required to prepare an Environmental
Assessment or an Environmental Impact Statement for any action that may
have a significant adverse effect on the human environment.\373\ We
conclude that that neither an Environmental Assessment nor an
Environmental Impact Statement is required for this final rule under
Sec.  380.4(a)(15) of the Commission's regulations, which provides a
categorical exemption for approval of actions under sections 205 and
206 of the FPA relating to the filing of schedules containing all rates
and charges for the transmission or sale of electric energy subject to
the Commission's jurisdiction, plus the classification, practices,
contracts, and regulations that affect rates, charges, classifications,
and services.\374\
---------------------------------------------------------------------------

    \373\ Regs. Implementing the Nat'l Env'l Pol'y Act, Order No.
486, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. ] 30,783
(1987) (cross-referenced at 41 FERC ] 61,284).
    \374\ 18 CFR 380.4(a)(15).
---------------------------------------------------------------------------

VI. Regulatory Flexibility Act

    214. The Regulatory Flexibility Act of 1980 (RFA) \375\ generally
requires a description and analysis of final rules that will have
significant economic impact on a substantial number of small entities.
The Small Business Administration's (SBA) Office of Size Standards
develops the numerical definition of a small business.\376\ The SBA
size standard for electric utilities is based on the number of
employees, ranging from 250 to 1,000 employees based on the electric
utility type.\377\ While this final rule is applicable to all small
utilities, participation with this final rule is voluntary for all
respondents, including small utilities. We estimate that the average
cost of voluntary participation for each utility to be $7,280 (initial
filing) plus an annual estimated cost of $3,640 for up to five years.
These initial and annual estimated costs would not constitute a
significant economic impact on affected entities of any size, including
small entities. Accordingly, the Commission certifies that this final
rule will not have a significant economic impact on a substantial
number of small entities.
---------------------------------------------------------------------------

    \375\ 5 U.S.C. 601-612.
    \376\ 13 CFR 121.101.
    \377\ 13 CFR 121.201.
---------------------------------------------------------------------------

VII. Document Availability

    215. In addition to publishing the full text of this document in
the Federal Register, the Commission provides all interested persons an
opportunity to view and/or print the contents of this document via the
internet through the Commission's Home Page (http://www.ferc.gov). At
this time, the Commission has suspended access to the Commission's
Public Reference Room due to the President's March 13, 2020
proclamation declaring a National Emergency concerning the Novel
Coronavirus Disease (COVID-19).
    216. From FERC's Home Page on the internet, this information is
available on eLibrary. The full text of this document is available on
eLibrary in PDF and Microsoft Word format for viewing, printing, and/or
downloading. To access this document in eLibrary, type the docket
number excluding the last three digits of this document in the docket
number field.
    217. User assistance is available for eLibrary and the FERC's
website during normal business hours from FERC Online Support at 202-
502-6652 (toll free at 1-866-208-3676) or email at
[email protected], or the Public Reference Room at (202) 502-
8371, TTY<PHONE_NUMBER>. Email the Public Reference Room at
[email protected].

VIII. Effective Date and Congressional Notification

    218. These regulations are effective [insert date 60 days from
publication in Federal Register]. The Commission has determined, with
the concurrence of the Administrator of the Office of Information and
Regulatory Affairs of OMB, that this rule is not a ``major rule'' as
defined in section 351 of the Small Business Regulatory Enforcement
Fairness Act of 1996.

List of Subjects in 18 CFR Part 35

    Electric power rates, Electric utilities, Reporting and
recordkeeping requirements.

    By the Commission. Commissioner Danly is dissenting with a
separate statement attached.

    Issued: April 21, 2023.
Debbie-Anne A. Reese,
Deputy Secretary.

    In consideration of the foregoing, the Commission hereby amends
part 35, chapter I, title 18, Code of Federal Regulations, as follows:

PART 35--FILING OF RATE SCHEDULES AND TARIFFS

0
1. The authority citation for part 35 continues to read as follows:

    Authority:  16 U.S.C. 791a-825r, 2601-2645; 31 U.S.C. 9701; 42
U.S.C. 7101-7352.

0
2. Add subpart K, consisting of Sec.  35.48, to read as follows:

Subpart K--Cybersecurity Investment Provisions

Sec.  35.48  Cybersecurity investment.

    (a) Purpose. This section establishes rules for incentive-based
rate treatments for utilities with rates on file with the Commission
that voluntarily make cybersecurity investments as described in this
section.
    (b) Definitions. As used in this section:
    Advanced Cybersecurity Technology means any technology, operational
capability, or service, including computer hardware, software, or a
related asset, that enhances the security posture of public utilities
through improvements in the ability to protect against, detect, respond
to, or recover from a cybersecurity threat (as defined in section 102
of the Cybersecurity Act of 2015 (6 U.S.C. 1501)).
    Advanced Cybersecurity Technology Information means information
relating to Advanced Cybersecurity Technology or proposed Advanced
Cybersecurity Technology that is generated by or provided to the
Commission or another Federal agency. Pursuant to FPA section 219A(g),
Advanced Cybersecurity Technology Information is considered to be
Critical Electric Infrastructure Information.
    Critical Energy/Electric Infrastructure Information (CEII) has the
same meaning as defined in 18 CFR 388.113.
    Electric Reliability Organization has the same meaning as defined
in Sec.  39.1 of this subchapter.
    Reliability Standard has the same meaning as defined in Sec.  39.1
of this subchapter.
    (c) Incentive-based rate treatment for cybersecurity investment.
The Commission will authorize incentive-based rate treatment for a
utility that voluntarily makes an investment in Advanced Cybersecurity
Technology and for a utility that voluntarily participates in a
cybersecurity threat information sharing program under this section,
provided that the utility meets the requirements of this section and
the utility demonstrates that the resulting rate is just and reasonable
and not unduly discriminatory or preferential, as required by sections
205 and 206 of the Federal Power Act. Incentive-based rate treatment is
available to both public and non-public utilities that have or will
have a rate on file with the Commission. A utility may request a single
incentive-based rate treatment as specified in paragraph (f) of this
section for an eligible cybersecurity investment that meets the
eligibility criteria set forth in paragraph (d) of this section.
    (d) Eligibility criteria. Pursuant to paragraphs (e) through (k) of
this section, a utility may receive incentive-based rate treatment for
a cybersecurity investment that:
    (1) Materially improves cybersecurity through either Advanced
Cybersecurity Technology or participation in a cybersecurity threat
information sharing program; and
    (2) Is not already mandated by the Reliability Standards as
maintained by the Electric Reliability Organization, or otherwise
mandated by local, State, or Federal law, decision, or directive;
otherwise legally mandated; or an action taken in response to a Federal
or State agency merger condition, consent decree from Federal or State
agency, or settlement agreement that resolves a dispute between a
utility and a public or private party.
    (e) Demonstrating satisfaction of the eligibility criteria. A
utility shall demonstrate to the Commission that a proposed
cybersecurity investment satisfies the eligibility criteria in
paragraph (d) of this section. Such demonstration shall show that the
cybersecurity investment fulfills at least one of the provisions in the
following paragraphs (e)(1) through (3):
    (1) A utility shall demonstrate that a cybersecurity investment
qualifies as one or more of the pre-qualified cybersecurity
investments. The Commission shall rebuttably presume that pre-qualified
cybersecurity investments satisfy the eligibility criteria. The
Commission shall maintain a list on its website of pre-qualified
cybersecurity investments and shall update such list from time to time
either subject to notice and comment procedures or in a rulemaking.
    (2) A utility shall demonstrate that a cybersecurity investment
satisfies each of the eligibility criteria in paragraph (d) of this
section. The Commission shall not presume that such demonstration
satisfies the eligibility criteria.
    (3) A utility shall demonstrate that it will make cybersecurity
investments to comply with a Reliability Standard that is approved by
the Commission but has not yet taken effect as approved by the
Commission. The Commission shall not presume that such demonstration
satisfies the eligibility criteria. Any incentives authorized by the
Commission pursuant to this section shall terminate when the
Reliability Standard takes effect.
    (f) Types of incentive-based rate treatment for cybersecurity
investment. For purposes of this section, incentive-based rate
treatment shall mean deferral of expenses as a regulatory asset.
    (g) Incentive duration. (1) A deferred Advanced Cybersecurity
Technology regulatory asset whose costs are typically expensed shall
be:
    (i) Amortized over a period of up to five years;
    (ii) Limited to expenses incurred in the first five years following
Commission approval of the incentive;
    (iii) Limited to ongoing expenses that the applicable utility was
not already undertaking more than three months prior to filing an
incentive request; and
    (iv) Terminated when the cybersecurity investment or activity that
serves as the basis of that incentive becomes mandatory.
    (2) An incentive granted for participation in a qualified
cybersecurity threat information sharing program will not be subject to
the five-year duration limitation provisions of paragraph (g)(1)(ii) of
this section for as long as the utility participates in the qualified
cybersecurity threat information sharing program and such participation
is not mandatory as to the utility. A utility participating in a
qualified cybersecurity threat information sharing program is eligible
to continue deferring expenses associated with such participation,
which for each year would be amortized over the next five years.
    (h) Incentive applications. For the purpose of this section, a
utility's request for incentive based-rate treatments for one or more
cybersecurity investments must be made in a filing pursuant to section
205 of the Federal Power Act, or in a petition for a declaratory order
that precedes a filing pursuant to section 205 of the Federal Power
Act. Utilities may file such a request either as a part of a general
rate request or on a single-issue basis. Such a request shall include a
detailed explanation to include the following information:

    (1) A demonstration that the cybersecurity investment satisfies the
eligibility criteria, which includes an attestation that cybersecurity
investment is not mandatory, as required by paragraph (d)(2) of this
section, and that the resulting rate is just and reasonable and not
unduly discriminatory or preferential; and
    (2) A detailed description of relevant cybersecurity expenses,
including whether such cybersecurity expenses are:
    (i) Associated with third-party provision of hardware, software,
computing networking services, and/or cybersecurity monitoring
services;
    (ii) For training to implement network analysis and monitoring
programs, and/or other cybersecurity protocols; and/or
    (iii) Other cybersecurity expenses;
    (3) Estimates of the cost of such cybersecurity expenses;
    (4) When the cybersecurity expenses are expected to be incurred;
and
    (5) An attestation that the utility either has not already been
undertaking duplicative or materially the same expenses for more than
three months or that the utility is participating in a cybersecurity
threat information-sharing program for the expense at issue. In the
case of cybersecurity investments made to comply with a Reliability
Standard that is approved by the Commission but has not yet taken
effect as approved by the Commission pursuant to paragraph (e)(3) of
this section, the utility must attest that it has not already been
undertaking duplicative or materially the same expenses for more than
three months prior to the date that the Commission's approval of the
Reliability Standard becomes effective.
    (i) Reporting requirements. A utility that has received Commission
approval for incentive-based rate treatment under this section shall
make an annual informational filing on June 1, provided that the