The Pennsylvania Public Utility Commission (PUC) has advanced a proposed rulemaking to modernize cybersecurity requirements for regulated electric, natural gas, water, wastewater and telecommunications utilities. The proposal is the culmination of a rulemaking process that began in 2022, when the Commission issued an Advance Notice of Proposed Rulemaking (ANPR) seeking stakeholder input on whether and how to strengthen its existing cybersecurity regulations.

In comments submitted in February 2023 (CLICK HERE), the PA Chamber supported maintaining the Commission’s existing performance-based regulatory framework. Specifically, the Chamber endorsed continuing the current self-certification model, under which utilities annually certify that they maintain and regularly test cybersecurity plans and programs rather than submitting those plans for Commission approval.

The Chamber also urged the PUC to avoid a “one-size-fits-all” regulatory approach, noting that utilities vary significantly in size, complexity and cyber risk. In addition, the Chamber cautioned against creating duplicative requirements where utilities are already subject to federal standards, insurance requirements or other cybersecurity obligations. Finally, the Chamber argued that any expansion of the regulations should be supported by a clear cost-benefit justification.

The proposed rule would replace the Commission’s existing cybersecurity self-certification framework with a more comprehensive regulatory structure. Under the proposal, utilities would be required to:

Among the key provisions, the proposal would:

• Require utilities to maintain cybersecurity programs aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
• Meet cybersecurity expectations that are scaled based on the size and complexity of their operations.
• Update cybersecurity program evaluation requirements.
• Modernize cyber incident reporting requirements and reporting criteria.
• Continue annual certifications that utilities maintain and regularly review their cybersecurity programs.
• Seek waivers from certain requirements when they can demonstrate compliance with equivalent cybersecurity standards.

The proposed rulemaking has been approved for publication in the Pennsylvania Bulletin, beginning the formal public comment period. Following the close of comments, the PUC will review stakeholder feedback and may revise the proposal before voting on a final rule. If adopted, the final regulation will also undergo review by the Independent Regulatory Review Commission (IRRC) before taking effect.