Evaluating the prudency of cybersecurity investments: Guidelines for Energy Regulators

Energy regulators have a unique role to play in the field of cybersecurity. While the implementation of cybersecurity measures is typically the responsibility of power system operators, regulators have an obligation to ensure that investments made in the name of cybersecurity are reasonable, prudent, and effective. These guidelines are intended to assist regulators in defining tariffs by establishing a regulatory approach to enhance the cybersecurity stance of their power systems, and are based on literature and current practices. They attempt to answer the following questions:

• Which regulatory frameworks are best suited to evaluate the prudency of cybersecurity expenditures?
• How can regulators identify and benchmark cybersecurity costs?
• How can regulators identify good countermeasures for cybersecurity?
• How can regulators assess the reasonableness of the costs associated with these countermeasures?
• Is it possible to evaluate the effectiveness of cybersecurity investments?
• Who should identify, benchmark, measure and evaluate the countermeasures in different regulatory frameworks?

As power systems modernize, digitize, and integrate, they are increasingly exposed to additional vulnerabilities that can be exploited by cyberattacks. Attacks on the power grid can have devastating effects on a nation’s security, economy, and public welfare, and are a potent threat to all nations worldwide.

The guidelines are a first-of-their-kind resource to empower energy regulators to support and encourage grid resilience by ensuring prudent and effective investments in cybersecurity by their regulated entities. The guidelines, melting competencies and wisdom from different disciplines, strive to provide space for concepts, processes and methods rather than prescriptive lists or ready-to-use formulas.

These guidelines were developed by CNR-Ircres for the National Association of Regulatory Utility Commissioners (NARUC) with funding support from the United States Agency for International Development (USAID) as part of the Europe and Eurasia Cybersecurity Partnership.

Elena Ragazzi (ed.), Alberto Stefanini, Daniele Benintendi, Ugo Finardi, and Dennis K. Holstein (2020). Evaluating the prudency of cybersecurity investments: Guidelines for Energy Regulators, NARUC, Washington DC.

(Russian Version)

Elena Ragazzi (2020). Costs and benefits of cybersecurity regulation. The terms of a complex assessment, Appendix 1 to  "Evaluating the prudency of cybersecurity investments: Guidelines for Energy Regulators" , NARUC, Washington DC.

Elena Ragazzi (ed), Ugo Finardi, Alberto Stefanini (2020) Summary of the main results of the ESSENCE project, Appendix 2 to  "Evaluating the prudency of cybersecurity investments: Guidelines for Energy Regulators" , NARUC, Washington DC.

Ugo Finardi, Elena Ragazzi, Alberto Stefanini (2020) EPRI cybersecurity metrics, Appendix 3 to  "Evaluating the prudency of cybersecurity investments: Guidelines for Energy Regulators" , NARUC, Washington DC.

 

Daniele Benintendi and Alberto Stefanini, Elena Ragazzi (2020) Implementing a cybersecurity regulation: the OFGEM approach, Appendix 4 to  "Evaluating the prudency of cybersecurity investments: Guidelines for Energy Regulators" , NARUC, Washington DC.