RM22-19 supporting statement

FERC-725B (OMB Control No. 1902-0248)

Proposed Rule (issued 9.22/2022) in Docket No. RM22-19-000

RIN: 1902-AG03

Supporting Statement for

FERC-725B, Revisions in RM22-19, Adding Voluntary Requests for Cybersecurity Incentives to Mandatory Reliability Standards for Critical Infrastructure Protection

The Federal Energy Regulatory Commission (Commission or FERC) requests that the Office of Management and Budget (OMB) review the revisions to the FERC-725B information collection as they would be implemented by the Notice of Proposed Rulemaking (NOPR) that was issued on September 22, 2022, in Docket No. RM22-19-000.

1. CIRCUMSTANCES THAT MAKE THE COLLECTION OF INFORMATION NECESSARY

The information collection in the NOPR would implement section 219A of the Federal Power Act (FPA),¹ which requires the Commission to encourage utilities to invest in advanced cybersecurity technology, and requires the Commission to encourage utilities to participate in information sharing regarding cybersecurity threats. The NOPR includes information collection activities for voluntary submission of requests for cybersecurity incentives, and informational filings that would be mandatory for utilities receiving such incentives. In order to obtain Commission approval, the proposed cybersecurity measures: (1) would have to materially improve cybersecurity through either an investment in advanced cybersecurity technology or participation in a cybersecurity threat information sharing program(s); and (2) would not be already mandated by CIP Reliability Standards, or otherwise mandated by local, state, or Federal law.

As previously approved, the information collection at FERC-725B implements Critical Infrastructure Protection (CIP) Reliability Standards that require entities to comply with specific requirements to safeguard critical cyber assets. Neither the NOPR nor this information collection request would affect the mandatory CIP Reliability Standards.

2. HOW, BY WHOM, AND FOR WHAT PURPOSE THE INFORMATION IS TO BE USED AND THE CONSEQUENCES OF NOT COLLECTING THE INFORMATION

Voluntary Filings Under FPA Section 205

The NOPR would provide a regulatory framework addressing how a utility could file voluntarily to obtain rate incentives for eligible cybersecurity expenditures. Under this framework, cybersecurity expenditures would be eligible for a rate incentive if they: (1) would materially improve cybersecurity through either an investment in advanced cybersecurity technology or participation in a cybersecurity threat information sharing program; and (2) are not already mandated by CIP Reliability Standards, or by local, state, or Federal law. A utility could seek a rate incentive in a filing pursuant to FPA section 205,² and the incentive would be effective no earlier than the date of the Commission order approving the incentive request.

Section 205 of the FPA authorizes the Commission to fix rates and charges collected by a public utility for transmitting or selling electric energy in interstate commerce. The rates or charges must be determined to be just and reasonable and not unduly preferential.

While sections 205 and 219A apply to “public utilities,” the NOPR would apply to both public utilities and to non-public utilities that have or will have a rate on file with the Commission. Non-public utilities have or will have rates on file with the Commission under 18 CFR 35.10b or 18 CFR 35.28.³ All references to “utilities” in this information collection request are intended to include both public utilities and non-public utilities that have or will have a rate on file with the Commission.

The NOPR would provide that the Commission could evaluate cybersecurity investments using a list of pre-qualified expenditures that are eligible for incentives determined by the Commission and publicly maintained on the Commission’s website (PQ List). With the Commission having evaluated expenditures to include on the PQ List in advance, the Commission believes that the PQ List approach would provide an efficient and transparent mechanism for determining appropriate cybersecurity expenditures that are eligible for incentives. Under the NOPR, any cybersecurity expenditure that is on the PQ List would be entitled to a rebuttable presumption of eligibility for an incentive. In the NOPR, the Commission also discusses and seeks comment on a potential alternative approach, whereby a utility’s cybersecurity expenditure would be evaluated on a case-by-case basis to determine if it is eligible for an incentive.

Two options are proposed for the type of incentive a utility could receive for an eligible cybersecurity expenditure: (1) a return on equity (ROE) adder of 200 basis points; or (2) deferred cost recovery for certain cybersecurity expenditures that enables the utility to defer expenses and include the unamortized portion in rate base.

Informational Filing

A utility that has received cybersecurity incentives under proposed section 35.48 would be required to make an annual informational filing by June 1, provided that the utility has received Commission-approval for the incentive at least 60 days prior to June 1 of that year. Utilities that receive Commission-approval for an incentive later than 60 days prior to June 1 would be required to submit an annual informational filing beginning on June 1 of the following year.⁴ The annual filing should detail the specific investments, if any, as of that date, that were made pursuant to the Commission’s approval and the corresponding FERC account for which expenditures are booked. For recipients of the Cybersecurity ROE Incentive, each annual informational filing should describe the parts of its network that it upgraded in addition to the nature and cost of the various investments. For recipients of the Regulatory Asset Incentive, each annual informational filing should describe such expenses in sufficient detail to demonstrate that such expenses are specifically related to the eligible cybersecurity investment underlying the incentives and not for ongoing services including system maintenance, surveillance, and other labor costs.

3. DESCRIBE ANY CONSIDERATION OF THE USE OF IMPROVED TECHNOLOGY TO REDUCE BURDEN AND TECHNICAL OR LEGAL OBSTACLES TO REDUCING BURDEN.

The proposed regulation at 18 CFR section 35.48(g) would provide that a utility’s request for one or more incentive based-rate treatments would be made in a filing pursuant to section 205 of the FPA and 18 CFR part 35. The regulation at 18 CFR 35.7 requires that all filings made in proceedings initiated under 18 CFR part 35 must be made electronically. The requirements and formats for electronic filing are available on the Internet.

4. DESCRIBE EFFORTS TO IDENTIFY DUPLICATION AND SHOW SPECIFICALLY WHY ANY SIMILAR INFORMATION ALREADY AVAILABLE CANNOT BE USED OR MODIFIED FOR USE FOR THE PURPOSE(S) DESCRIBED IN INSTRUCTION NO. 2

Filing requirements are periodically reviewed as OMB review dates arise or as the Commission may deem necessary in carrying out its regulatory responsibilities under the FPA in order to eliminate duplication and ensure that filing burden is minimized. There are no similar sources for information available that can be used or modified for these reporting purposes.

5. METHODS USED TO MINIMIZE BURDEN IN COLLECTION OF INFORMATION INVOLVING SMALL ENTITIES

As of August 5, 2022, the NERC Compliance Registry identifies approximately 1,669 utilities, both public and non-public, in the U.S. that potentially would be affected by the voluntary information collection associated with the proposed incentive and rate treatment in the NOPR. We have reviewed a random sample of 92 entities listed on the Registry, and we have determined that approximately 80 percent of them are small entities (i.e., with fewer than 500 employees) under the standards of the Small Business Administration at 13 CFR 131.201.

The paperwork burdens under the NOPR for small entities would be identical to the paperwork burdens for other entities, and would impose minimal burdens that we believe would be within the standards of the PRA.

6. CONSEQUENCE TO FEDERAL PROGRAM IF COLLECTION WERE CONDUCTED LESS FREQUENTLY

The collection of voluntary rate-incentive filings “on occasion,” as provided by the NOPR, is integral to the Commission’s compliance with the requirement of section 219A to

encourage utilities to invest in advanced cybersecurity technology, and to encourage utilities to participate in information sharing regarding cybersecurity threats. The consequence of collecting this information less frequently would be detrimental to the Commission’s fulfillment of that statutory obligation.

Without the collection of informational filings annually, the Commission would be hindered in ensuring that a utility receiving incentive rate treatment has implemented the requirements of the incentive and ensuring that the utility continues to adhere to the requirements.

7. EXPLAIN ANY SPECIAL CIRCUMSTANCES RELATING TO THE INFORMATION COLLECTION

FERC-725B information collection has no special circumstances.

8. DESCRIBE EFFORTS TO CONSULT OUTSIDE THE AGENCY: SUMMARIZE PUBLIC COMMENTS AND THE AGENCY'S RESPONSE TO THESE COMMENTS

The NOPR was published in the Federal Register on October 6, 2022 (87 FR 60567), thereby providing public utilities and licensees, state commissions, Federal agencies, and other interested parties an opportunity to submit data, views, comments or suggestions concerning the proposed collections of data.

9. EXPLAIN ANY PAYMENT OR GIFTS TO RESPONDENTS

No payments or gifts have been made to respondents.

10. DESCRIBE ANY ASSURANCE OF CONFIDENTIALITY PROVIDED TO RESPONDENTS

The NOPR would provide no assurance of confidentiality. However, a respondent may request confidential treatment of Critical Energy/Electric Infrastructure Information (CEII) under 18 CFR 388.133.

11. PROVIDE ADDITIONAL JUSTIFICATION FOR ANY QUESTIONS OF A SENSITIVE NATURE, SUCH AS SEXUAL BEHAVIOR AND ATTITUDES, RELIGIOUS BELIEFS, AND OTHER MATTERS THAT ARE COMMONLY CONSIDERED PRIVATE

This collection does not contain any questions of a sensitive nature.

12. ESTIMATED BURDEN OF COLLECTION OF INFORMATION

The Commission estimates that the NOPR would affect the burden⁵ and cost⁶ as follows:

Table 12

FERC-725B, Proposed Changes in NOPR in Docket No. RM22-19-000

A. Area of Modification	B. Number of Respondents	C. Annual Estimated Number of Responses per Respondent	D. Annual Estimated Number of Responses (Column B x Column C)	E. Average Burden Hours & Cost ($) per Response	F. Total Estimated Burden Hours & Total Estimated Cost ($) (Column D x Column E)
Voluntary filing seeking incentive rate treatment for cybersecurity investment (Proposed 18 CFR 35.48(b))	50	1	50	80 hours; $7,280	4,000 hours; $364,000
Annual informational filing required where Commission has granted incentive rate treatment (Proposed 18 CFR 35.48(h))	50	1	50	40 hours; $3,640	2,000 hours; $182,000
Totals	100				6,000 hours; $546,000

13. ESTIMATE OF THE TOTAL ANNUAL COST BURDEN TO RESPONDENTS

There are no start-up or other non-labor costs.

Total Capital and Start-up cost: $0

Total Operation, Maintenance, and Purchase of Services: $0

All costs are due to this NOPR are associated with burden hours (labor) and described in Questions #12 and #15 in this supporting statement.

14. ESTIMATED ANNUALIZED COST TO FEDERAL GOVERNMENT

The Commission would incur costs associated with processing filings under the NOPR, and in obtaining OMB clearance under the Paperwork Reduction Act (PRA). The estimated processing cost total $188,992 annually. The Commission estimates receiving 20 informational filings per year under the NOPR, with each filing estimated to take approximately 100 hours to analyze and process, totaling the number of hours and cost of one FTE.

The estimated PRA Administrative Cost of $7,694 is a federal cost associated with preparing, issuing, and submitting materials necessary to comply with the PRA for rulemakings, orders, or any other vehicle used to create, modify, extend, or discontinue an information collection. This average annual cost includes requests for extensions, all associated rulemakings and orders, other changes to the collection, and associated publications in the Federal Register.

As shown in the table below, $196,686 is the sum of the estimated annual federal cost of analyzing and processing the filings (which is the annual salary for one Full-Time Equivalent (FTE) of $188,992) plus the estimated PRA administrative cost of $7,694.

Table 14

Estimated Annual Federal Costs

FERC-725B	Number of Employees (FTEs)	Estimated Annual Federal Cost
Analysis and Processing of Filings	1	$188,992
Paperwork Reduction Act Administrative Cost		$7,694
TOTAL		$196,686

15. REASONS FOR CHANGES IN BURDEN INCLUDING THE NEED FOR ANY INCREASE

All of the estimated burdens described above in Discussion # 12 would be additional to the existing burdens of FERC-725B. They would be program changes to FERC-725B.

As shown below in Table 15, the estimated annual burdens of the NOPR would add 100 responses and 6,000 hours to FERC-725B. The resulting total burdens for FERC-725-B would be 241,101 responses and 2,168,901 hours.

Table 15

Changes in FERC-725B That Would Result From the NOPR in RM22-19-000

A. Type of Response	B. Previously Approved Responses and Burden Hours7	C. Requested Responses and Burden Hours	D. Program Changes Due to Agency Discretion (Column C – Column B)
CIP-002-5.1a	1,492 responses; 29,840 hours	No changes	No changes
CIP-003-8	232,976 responses; 363,442 hours	No changes	No changes
CIP-004-6	343 responses; 193,795 hours	No changes	No changes
CIP-005-7	343 responses; 180,075 hours	No changes	No changes
CIP-006-6	343 responses; 79,576 hours	No changes	No changes
CIP-007-6	343 responses; 713,440 hours	No changes	No changes
CIP-008-6	2,744 responses; 36,288 hours	No changes	No changes
CIP-009-6	343 responses; 55,566 hours	No changes	No changes
CIP-010-3	343 responses; 401,996 hours	No changes	No changes
CIP-011-2	343 responses; 29,498 hours	No changes	No changes
CIP-012-1	724 responses; 62,025 hours	No changes	No changes
CIP-013-1	343 responses; 6,860 hours	No changes	No changes
CIP-014-2	321 responses; 10,500 hours	No changes	No changes
Voluntary filing seeking incentive rate treatment for cybersecurity investment (Proposed 18 CFR 35.48(b))	0 responses; 0 hours	50 responses; 4,000 hours	Additional 50 responses and 4,000 hours
Annual informational filing required where Commission has granted incentive rate treatment (Proposed 18 CFR 35.48(h))	0 responses; 0 hours	50 responses; 2,000 hours	Additional 50 responses and 2,000 hours
Totals	241,001 responses; 2,162,901 hours	100 responses; 6,000 hours	Additional 100 responses and 6,000 hours. Total burdens for FERC-725B would be 241,101 responses and 2,168,901 hours.

16. TIME SCHEDULE FOR THE PUBLICATION OF DATA

There would be no tabulating, statistical or publication plans in accordance with the NOPR.

17. DISPLAY OF THE EXPIRATION DATE

The expiration date would be displayed in a table posted on ferc.gov at Information-Collections-8-31-2022.xlsx.

18. EXCEPTIONS TO THE CERTIFICATION STATEMENT

There are no exceptions.

1 FPA section 219A was enacted as part of the Infrastructure and Jobs Act, Pub. L. 117-58, section 40123, 135 Stat. 429, at 951 (Nov. 15, 2021) (to be codified at 16 U.S.C. 824s-1).

2 16 U.S.C. 824d.

3 The regulation at 18 CFR 35.10b requires non-public utilities with more than a de minimis market presence to file with the Commission an updated Electric Quarterly Report for each of the four calendar quarters of each year, covering “electric service,” as defined at 18 CFR 35.2(a). The regulation at 18 CFR 35.28 authorizes any non-public utility to submit an open-access transmission tariff and a request for a declaratory order that its voluntary transmission tariff meets the requirements of a pro forma tariff.

4 If a utility first receives Commission-approval for the incentive on April 1 or later, the initial annual informational filing would be due on June 1 of the following year.

5 “Burden” is the total time, effort, or financial resources expended by persons to generate, maintain, retain, or disclose or provide information to or for a Federal agency. For further explanation of what is included in the information collection burden, refer to 5 CFR 1320.3.

6 Commission staff estimates that respondents’ hourly wages (including benefits) are comparable to those of FERC employees. Therefore, the hourly cost used in this analysis is $91.00.

7 The numbers shown in this column are those that are shown in ROCIS, which automatically rounded some of the numbers shown in the supporting statement.

8