Cybersecurity as a precondition for the carbon–neutral grid: an investment framework for U.S. utility cybersecurity capital allocation

Abstract

Abstract The transition to a carbon–neutral electricity system depends on the widespread integration of distributed and inverter-based renewable resources. The U.S. Department of Energy and the North American Electric Reliability Corporation have identified these resources as increasing the grid's cybersecurity attack surface faster than current oversight can manage. Federal reviews have also found that guidance for assessing grid cybersecurity risk remains incomplete. In response, the Federal Energy Regulatory Commission has introduced a mandatory internal network monitoring standard and, for the first time, a voluntary financial incentive for cybersecurity investment beyond compliance requirements. However, neither these measures nor the academic literature on security economics and infrastructure capital budgeting provides a clear method for allocating cybersecurity capital as distributed and renewable generation continues to expand. This paper develops a four-component investment appraisal framework that combines the compliance floor established by NERC's Critical Infrastructure Protection standards, the loss-based investment benchmark implied by the Gordon-Loeb model, the timing flexibility provided by real options analysis, and the rate-recovery incentive created by FERC Order No. 893. The framework is applied to the cybersecurity risks associated with distributed energy resource growth in a decarbonizing electric grid. The paper's contribution is methodological rather than empirical. Its application is illustrated using the documented experience of California's CES-21 program and published industry and regulatory benchmarks rather than a hypothetical case. The paper concludes by identifying the empirical research needed before the framework can be calibrated to an actual utility capital plan.