Regulatory approaches to cybersecurity investments

Following natural disasters, cyberattacks, or other disruptions to the supply of electricity, utilities often seek guidance from regulators on measures to address their financial concerns as they continue to provide reliable service to their customers. The objective of this webinar series is to examine how regulators can consider the short and long-term implications of the COVID-19 global pandemic on the energy sector. This webinar series will discuss the practical tariff treatments that regulators can consider as the impacts of the pandemic continue to play out. Whether the sector is unbundled or vertically integrated, all utilities are facing issues that have never been encountered before. The expert panelists will contextualize a variety of tariff-related issues and potential treatments, discussing the implications regulators should consider. For example, while deferrals on payments provide relief for consumers (which may be prudent given the massive unemployment resulting from COVID-19), utilities need to avoid being put into a situation that potentially harms their long-term economic viability. Experts have warned of an increase in cybersecurity threats as the COVID-19 pandemic creates opportunities for malign actors to increase their cyberattacks. Vulnerabilities have also increased as resources continue to be limited, and software updates become less frequent. As such, it is even more important for regulators and utilities to further cooperate and employ necessary cybersecurity investments during this time, despite the financial and resource constraints. During this portion of the webinar series, NARUC will present its new report, Evaluating the Prudency of Cybersecurity Investments: Guidelines for Energy Regulators, funded by the U.S. Agency for International Development (USAID). While the implementation of cybersecurity measures is typically the responsibility of power system operators, regulators have an obligation to ensure that investments made in the name of cybersecurity are reasonable, prudent, and effective. These guidelines are intended to assist regulators in defining tariffs by establishing a regulatory approach to enhance the cybersecurity stance of their power systems.