Pa. PUC Denies Complaint From Retail Suppliers Seeking To Void Utility's $5 Million Cybersecurity Insurance Requirement -- EnergyChoiceMatters.com

Pa. PUC Denies Complaint From Retail Suppliers Seeking To Void Utility's $5 Million Cybersecurity Insurance Requirement

April 14, 2022

Email This Story
Copyright 2010-21 EnergyChoiceMatters.com
Reporting by Paul Ring • ring@energychoicematters.com

The following story is brought free of charge to readers by EC Infosystems, the exclusive EDI provider of EnergyChoiceMatters.com

Affirming an ALJ's initial decision, the Pennsylvania PUC denied a complaint brought by a group of retail suppliers (NGSs) against National Fuel Gas Distribution Corporation (NFGD) in which the suppliers sought to void an NFGD tariff adopted by the Pennsylvania PUC that includes a $5,000,000 per incident cybersecurity insurance requirement, as well as an associated Data Security Agreement (DSA) and Self Attestation (SA)

The ALJ summarized that, at issue here, is the lawfulness and reasonableness of NFGD’s Tariff Supplement 207, specifically the DSA and SA with the requirement that NGSs carry $5,000,000 cybersecurity insurance coverage.

The ALJ noted that, "The requirement has already been approved by the Commission and is part of NFGD’s lawfully filed tariff." Adoption of the requirement had been first reported by EnergyChoiceMatters.com

See a full discussion of the initial decision in our prior story here

The PUC's decision addresses various exceptions from suppliers to the initial decision

Among other things, retail suppliers argued that the insurance requirement amounts to an additional financial security required by the utility, which is not authorized by statute or regulation

However, the PUC found that the statute only addresses financial security (bonding) for SOLR drops, and the PUC did not find that the insurance requirement amounted to an additional financial security

Concerning this issue, the PUC said, "We agree with the ALJ that this section of the Code, in addition to the Commission’s Regulation at 52 Pa. Code § 62.111, is a bonding requirement for natural gas suppliers. As the ALJ and NFGD explained, the bond or financial security provided for under these sections of the Code and Commission’s Regulations are in place to account for the financial impact on a natural gas distribution company or alternative supplier of last resort in case of a default or bankruptcy of a natural gas supplier. These sections of the Code and Commission’s Regulations do not, however, preclude further security requirements for other purposes that may be imposed on a natural gas supplier."

"The purpose of the cybersecurity insurance requirement in Tariff Supplement No. 207 is different than the purpose of the financial security requirements at 66 Pa. C.S. § 2208 and 52 Pa. Code § 62.111. I.D. at 22-23; NFGD R.B. at 18. Therefore, we conclude that the cybersecurity insurance requirement is reasonable due to the increasing risk faced by utilities and customers of cyber-attacks and their potential impact to utility systems," the PUC said

Addressing another exception from NGSs, the PUC found that Tariff Supplement No. 207, specifically the audit requirement provision, does not abrogate the Commission’s authority to regulate natural gas suppliers under 66 Pa. C.S. § 2208.

"There is nothing in 66 Pa. C.S. § 2208 that precludes public utilities from having reasonable rules and regulations governing the relationship with energy suppliers operating on their systems, and a tariff providing for a utility to audit a natural gas supplier to ensure compliance with its tariff rules is reasonable," the PUC said

"Furthermore, we agree with the ALJ’s conclusion that the Joint Complainants and PIOGA did not present persuasive evidence to establish that the cybersecurity insurance requirement, including the audit requirement, is discriminatory and a barrier to market entry," the PUC said.

The PUC also denied exceptions from NGSs which had alleged that NFGD had "misrepresented" the tariff by stating, at one point, that it was mirrored at a data security requirement in New York (New York ultimately adopted a different requirement which no longer mirrors the Pa. tariff)

On this issue, the PUC said, "Upon review of the record, we find that the ALJ did not ignore the record evidence and, after weighing the evidence presented, correctly held that NFGD did not misrepresent the basis for the Commission approving Tariff Supplement No. 207. We agree with the ALJ that natural gas suppliers, including the Joint Complainants, were notified by NFGD of the Tariff Supplement No. 207 filing in June 2019, that they had notice and an opportunity to be heard before the Commission approved Tariff Supplement No. 207, including the cybersecurity insurance requirement, and that no complaints were filed before the tariff was approved and became effective in August 2019."

"Moreover, there is nothing in the record to persuade us to overturn the ALJ’s conclusion that the Joint Complainants did not present substantial evidence that they were intentionally misled or misrepresented by NFGD to persuade them not to participate in the Tariff Supplement No. 207 proceeding in 2019. The very heavy burden necessary to be satisfied in order to void an already filed and approved tariff provision has not been met here," the PUC said

Docket C-2020-3019621

Email This Story

HOME