§35.48. Cybersecurity investment. — Inbound Citations

(d) Pursuant to paragraphs (e) through (j) of this section, a utility may receive incentive-based rate treatment for a cybersecurity investment that:

(1) Materially improves cybersecurity through either Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program; and

(2) Is not already mandated by the Reliability Standards as maintained by the Electric Reliability Organization, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition, consent decree from Federal or State agency, or settlement agreement that resolves a dispute between a utility and a public or private party.

(e) A utility shall demonstrate to the Commission that a proposed cybersecurity investment satisfies the eligibility criteria in paragraph (d) of this section. Such demonstration shall show that the cybersecurity investment fulfills at least one of the provisions in the following paragraphs (e)(1) through (3):

(1) A utility shall demonstrate that a cybersecurity investment qualifies as one or more of the pre-qualified cybersecurity investments. The Commission shall rebuttably presume that pre-qualified cybersecurity investments satisfy the eligibility criteria. The Commission shall maintain a list on its website of pre-qualified cybersecurity investments and shall update such list from time to time either subject to notice and comment procedures or in a rulemaking.

(2) A utility shall demonstrate that a cybersecurity investment satisfies each of the eligibility criteria in paragraph (d) of this section. The Commission shall not presume that such demonstration satisfies the eligibility criteria.

(3) A utility shall demonstrate that it will make cybersecurity investments to comply with a Reliability Standard that is approved by the Commission but has not yet taken effect as approved by the Commission. The Commission shall not presume that such demonstration satisfies the eligibility criteria. Any incentives authorized by the Commission pursuant to this section shall terminate when the Reliability Standard takes effect.

(e) A utility shall demonstrate to the Commission that a proposed cybersecurity investment satisfies the eligibility criteria in paragraph (d) of this section. Such demonstration shall show that the cybersecurity investment fulfills at least one of the provisions in the following paragraphs (e)(1) through (3):

(1) A utility shall demonstrate that a cybersecurity investment qualifies as one or more of the pre-qualified cybersecurity investments. The Commission shall rebuttably presume that pre-qualified cybersecurity investments satisfy the eligibility criteria. The Commission shall maintain a list on its website of pre-qualified cybersecurity investments and shall update such list from time to time either subject to notice and comment procedures or in a rulemaking.

(2) A utility shall demonstrate that a cybersecurity investment satisfies each of the eligibility criteria in paragraph (d) of this section. The Commission shall not presume that such demonstration satisfies the eligibility criteria.

(3) A utility shall demonstrate that it will make cybersecurity investments to comply with a Reliability Standard that is approved by the Commission but has not yet taken effect as approved by the Commission. The Commission shall not presume that such demonstration satisfies the eligibility criteria. Any incentives authorized by the Commission pursuant to this section shall terminate when the Reliability Standard takes effect.

(e) A utility shall demonstrate to the Commission that a proposed cybersecurity investment satisfies the eligibility criteria in paragraph (d) of this section. Such demonstration shall show that the cybersecurity investment fulfills at least one of the provisions in the following paragraphs (e)(1) through (3):

(1) A utility shall demonstrate that a cybersecurity investment qualifies as one or more of the pre-qualified cybersecurity investments. The Commission shall rebuttably presume that pre-qualified cybersecurity investments satisfy the eligibility criteria. The Commission shall maintain a list on its website of pre-qualified cybersecurity investments and shall update such list from time to time either subject to notice and comment procedures or in a rulemaking.

(2) A utility shall demonstrate that a cybersecurity investment satisfies each of the eligibility criteria in paragraph (d) of this section. The Commission shall not presume that such demonstration satisfies the eligibility criteria.

(3) A utility shall demonstrate that it will make cybersecurity investments to comply with a Reliability Standard that is approved by the Commission but has not yet taken effect as approved by the Commission. The Commission shall not presume that such demonstration satisfies the eligibility criteria. Any incentives authorized by the Commission pursuant to this section shall terminate when the Reliability Standard takes effect.

(d) Pursuant to paragraphs (e) through (j) of this section, a utility may receive incentive-based rate treatment for a cybersecurity investment that:

(1) Materially improves cybersecurity through either Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program; and

(2) Is not already mandated by the Reliability Standards as maintained by the Electric Reliability Organization, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition, consent decree from Federal or State agency, or settlement agreement that resolves a dispute between a utility and a public or private party.

(d) Pursuant to paragraphs (e) through (j) of this section, a utility may receive incentive-based rate treatment for a cybersecurity investment that:

(1) Materially improves cybersecurity through either Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program; and

(2) Is not already mandated by the Reliability Standards as maintained by the Electric Reliability Organization, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition, consent decree from Federal or State agency, or settlement agreement that resolves a dispute between a utility and a public or private party.

(d) Pursuant to paragraphs (e) through (j) of this section, a utility may receive incentive-based rate treatment for a cybersecurity investment that:

(1) Materially improves cybersecurity through either Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program; and

(2) Is not already mandated by the Reliability Standards as maintained by the Electric Reliability Organization, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition, consent decree from Federal or State agency, or settlement agreement that resolves a dispute between a utility and a public or private party.

(d) Pursuant to paragraphs (e) through (j) of this section, a utility may receive incentive-based rate treatment for a cybersecurity investment that:

(1) Materially improves cybersecurity through either Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program; and

(2) Is not already mandated by the Reliability Standards as maintained by the Electric Reliability Organization, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition, consent decree from Federal or State agency, or settlement agreement that resolves a dispute between a utility and a public or private party.

(d) Pursuant to paragraphs (e) through (j) of this section, a utility may receive incentive-based rate treatment for a cybersecurity investment that:

(1) Materially improves cybersecurity through either Advanced Cybersecurity Technology or participation in a cybersecurity threat information sharing program; and

(2) Is not already mandated by the Reliability Standards as maintained by the Electric Reliability Organization, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition, consent decree from Federal or State agency, or settlement agreement that resolves a dispute between a utility and a public or private party.