16 U.S.C. § 824s–1 — Incentives for cybersecurity investments

(a) Definitions. In this section:nn(1) “Advanced cybersecurity technology” means any technology, operational capability, or service—including computer hardware, software, or a related asset—that improves public utilities’ ability to protect against, detect, respond to, or recover from a “cybersecurity threat.” This section does not define “cybersecurity threat”; it refers to the definition in section 650 of title 6.nn(2) “Advanced cybersecurity technology information” means information about advanced cybersecurity technology or proposed advanced cybersecurity technology that the Commission or another Federal agency generates or receives.nn(b) Study. Within 180 days after November 15, 2021, the Commission must consult with the Secretary of Energy, the North American Electric Reliability Corporation, the Electricity Subsector Coordinating Council, and the National Association of Regulatory Utility Commissioners. Then the Commission must conduct a study. The study must identify incentive-based rate treatments, including performance-based rate treatments, for the transmission and sale of electric energy under the Commission’s jurisdiction. The study must identify treatments that could encourage:nn(1) public utilities to invest in advanced cybersecurity technology; andnn(2) public utilities to participate in cybersecurity threat information sharing programs.nn(c) Incentive-based rate treatment. Within 1 year after completing the study under subsection (b), the Commission must establish, by rule, incentive-based rate treatments, including performance-based rate treatments. These treatments must apply to the interstate transmission of electric energy and the wholesale interstate sale of electric energy by public utilities. They must benefit consumers by encouraging:nn(1) public utilities’ investments in advanced cybersecurity technology; andnn(2) public utilities’ participation in cybersecurity threat information sharing programs.nn(d) Factors for consideration. When issuing a rule under this section, the Commission may provide incentives in addition to those identified in subsection (c) if it determines that the costs of an investment in advanced cybersecurity technology or an information sharing program will reduce cybersecurity risks to:nn(1) defense critical electric infrastructure, as defined in section 824o–1(a) of this title, and other facilities under the Commission’s jurisdiction that are critical to public safety, national defense, or homeland security. The Commission must make this determination in consultation with:nn(A) the Secretary of Energy;nn(B) the Secretary of Homeland Security; andnn(C) other appropriate Federal agencies; andnn(2) facilities of small or medium-sized public utilities that have limited cybersecurity resources, as determined by the Commission.nn(e) Ratepayer protection.nn(1) In general. Every rate approved under a rule issued under this section, including a revised rule, must meet the requirements of sections 824d and 824e of this title. Under those requirements, all rates, charges, terms, and conditions:nn(A) must be just and reasonable; andnn(B) must not be unduly discriminatory or preferential.nn(2) Prohibition of duplicate recovery. Every rule issued under this section must prevent rate treatments that allow unjust and unreasonable double recovery for advanced cybersecurity technology.nn(f) Single-issue rate filings. The Commission must allow public utilities to apply for incentive-based rate treatment under a rule issued under this section on a single-issue basis. To do so, a utility must submit to the Commission a tariff schedule under section 824d of this title. The tariff schedule must allow the utility to recover costs and incentives over the applicable assets’ depreciable lives, without considering changes in the utility’s receipts or other costs.nn(g) Protection of information. Any advanced cybersecurity technology information that the Federal Government receives, generates, or collects under subsection (b), (c), or (f) must be treated as critical electric infrastructure information under section 824o–1 of this title.