A four-step framework for utility cybersecurity spending on the carbon-neutral grid

The transition to a carbon-neutral electricity system depends on millions of distributed, inverter-based renewable resources such as rooftop solar and battery storage. The U.S. Department of Energy projected that installed distributed energy resource capacity would roughly quadruple between the early 2020s and 2025, and warned that a sufficiently large aggregation of these devices could pose a reliability risk if compromised by a capable attacker. Yet the fastest-growing part of the grid’s cyber-attack surface, distribution-connected resources, sits largely outside the mandatory cybersecurity standards that govern the bulk power system. A new open-access review published in the journal Carbon Neutral Systems on 3 October 2026 argues that this mismatch leaves utilities without any systematic method for deciding how much discretionary cybersecurity capital to spend, when to spend it, and how to finance it, and it proposes a four-component investment appraisal framework to fill that void.

The paper, authored by Stefan Daniel Anim-Sampong, Kwaku Mensah-Bonsu and Isaac Larbi, is explicitly methodological rather than empirical. It does not analyze utility data, company financial results or original threat statistics. Instead, it integrates four elements that previously existed only as separate regulatory tools or academic literatures: the compliance floor established by the North American Electric Reliability Corporation’s Critical Infrastructure Protection standards, the loss-based spending benchmark implied by the Gordon-Loeb model of information security economics, the timing flexibility offered by real options analysis, and the lower effective cost of capital available under Federal Energy Regulatory Commission Order No. 893. The authors contend that the value of the framework lies precisely in this sequencing, because each component changes the inputs to the next.

The regulatory backdrop is one of documented, repeated gaps. In 2019, the U.S. Government Accountability Office reported that the Department of Energy’s approach to electric-grid cybersecurity risk assessment relied on an outdated methodology, that mandatory reliability standards reflected only portions of leading federal cybersecurity practices, and that compliance audits did not assess the risk of coordinated attacks against multiple grid assets simultaneously. Roughly eighteen months later, a second GAO report found that the Department of Energy’s national cybersecurity strategy focused primarily on generation and transmission while giving comparatively less attention to distribution systems, where most distributed energy resource interconnections occur. At the time of GAO’s most recent public update, the recommendation tied to that finding remained open.

Federal regulators have responded on two fronts. In February 2023, FERC directed NERC to develop a mandatory internal network security monitoring standard for high- and medium-impact bulk electric system cyber systems, requiring utilities to establish baselines of expected network activity, detect unauthorized activity within monitored environments, and maintain logging and evidence-preservation capabilities. The resulting standard, CIP-015-1, was approved in 2025. FERC also introduced, for the first time, a voluntary financial incentive for cybersecurity investments that exceed mandatory requirements: eligible spending may receive either a return-on-equity adder or deferred cost recovery, with incentives generally available for up to five years from the date the qualifying expense is incurred. The pre-qualified list includes participation in the Cybersecurity Risk Information Sharing Program and internal network security monitoring investments.

Neither measure, however, tells a utility how to weigh a marginal dollar of cybersecurity spending against a marginal dollar spent on any other reliability investment. The paper’s first framework component treats compliance as a floor rather than an optimization variable: obligations under CIP-013-2, the supply chain risk management standard approved by FERC in March 2021, and CIP-015-1 are entered as fixed, non-discretionary capital requirements with their own deadlines. Because distribution-connected distributed energy resources and their aggregators generally fall outside mandatory CIP coverage, investments to protect them are assessed under the second component instead, even though a single aggregator may coordinate hundreds or thousands of renewable and storage resources, concentrating risk far beyond what any individual device represents.

That second component applies a Gordon-Loeb-style loss-based benchmark to every candidate investment above the compliance floor. The model, developed by Gordon and Loeb in 2002, demonstrates that security spending exhibits diminishing returns and should be limited to an amount justified by the expected loss a breach would cause; for one class of vulnerability functions, optimal investment should not exceed roughly 1/e, or about 37 percent, of the expected loss the investment is designed to avert. To illustrate the mechanics, the authors offer a stylized example, explicitly not tied to any real utility: a compromised set of distributed energy resource aggregator connections with an estimated loss of 5.5 million dollars and a 4 percent annual breach probability yields an expected loss of about 220,000 dollars per year, and the 37 percent threshold produces a screening benchmark of roughly 80,000 dollars annually. Proposals substantially above such a ceiling would be rejected or resized rather than approved on the strength of a qualitative threat narrative.

Investments that pass the loss screen move to a real-options staging stage, which asks whether phased capital deployment creates more value than immediate full-scale commitment as uncertainties about regulatory guidance, technology maturity and distributed energy adoption gradually resolve. A utility might begin with a pilot deployment and expand only if performance targets are met. The final component ranks the surviving projects alongside transmission upgrades, generation interconnection and distribution hardening using an incentive-adjusted internal rate of return, with qualifying investments evaluated at a lower effective cost of capital under Order No. 893 and nonqualifying ones at the utility’s standard weighted average cost of capital. Because the framework’s components are interdependent, the authors stress that capital planning should be iterative: a compliance reclassification can turn a discretionary measure into a mandatory one, and phased projects should have incentive eligibility evaluated separately for each stage within the five-year window.

The paper illustrates the stakes with a documented historical precedent rather than a hypothetical case. In December 2012, the California Public Utilities Commission authorized California Energy Systems for the 21st Century, a joint research program of Pacific Gas and Electric Company, Southern California Edison and San Diego Gas & Electric with Lawrence Livermore National Laboratory, at up to 30 million dollars annually for five years, a total of 152.19 million dollars. After state legislation narrowed the program’s scope, a 2014 decision cut the authorized budget to 35 million dollars over the same period, an approximately 77 percent reduction that fell most heavily on the cybersecurity and grid-integration research at issue. The authors are careful about what this shows: the program predates the current standards and incentive, no explicit expected-loss threshold was applied to the original request, and whether such an analysis would have changed the outcome cannot be determined from the public record. What the episode documents is a cybersecurity capital request lacking a defensible basis for its appropriate scale.

The current evidence base remains thin. According to FERC’s most recent tracking, no utility has yet applied for cybersecurity incentive treatment under Order No. 893, a lack of participation attributed by the law firm Morgan Lewis to narrow eligibility criteria and limited expected benefits relative to application uncertainty. FERC’s cost estimate for CIP-015-1 covers only administrative compliance, about 32,116 dollars per affected entity annually across roughly 400 of NERC’s 1,636 CIP-compliant entities, excluding technology acquisition and integration costs. Utilities therefore lean on external benchmarks such as IBM’s reported average global data-breach cost of 4.44 million dollars in 2025 and average industrial-sector breach cost of 5.56 million dollars in 2024, figures the paper flags as broad cross-industry averages rather than grid-specific estimates. Meanwhile, an estimated 217 gigawatts of additional distributed energy capacity is projected to be deployed by 2028.

The authors are candid about the framework’s limits. Expected losses from grid cyber incidents, especially distributed energy aggregator compromises, remain difficult to estimate; the Gordon-Loeb model was not built for risks with reliability and public-safety dimensions; real options analysis requires uncertainty estimates that are hard to develop in a rapidly shifting environment; and the framework has not been tested against an actual utility capital plan. They call for case studies using anonymized utility data, grid-specific expected-loss research, investigation of why the Order No. 893 incentive has attracted no users, and sensitivity analyses of the staging component. They also note a practical obstacle: utilities may resist disclosing expected-loss estimates in public proceedings, though existing confidential-review mechanisms could allow regulators to evaluate such figures without exposing sensitive threat information. Until that empirical work is done, the framework stands as a proposed sequence of decisions, not a validated tool, for steering cybersecurity capital toward the distributed renewable assets a decarbonizing grid is adding fastest.

Subject of Research: An investment appraisal framework for allocating U.S. utility cybersecurity capital amid distributed renewable energy growth

Article Title: Cybersecurity as a precondition for the carbon–neutral grid: an investment framework for U.S. utility cybersecurity capital allocation

Article References: Anim-Sampong, S. D., Mensah-Bonsu, K., & Larbi, I. (2026). Cybersecurity as a precondition for the carbon–neutral grid: an investment framework for U.S. utility cybersecurity capital allocation. Carbon Neutral Systems, 2(1), Article 19. https://doi.org/10.1007/s44438-026-00040-4

Image Credits: AI Generated

DOI: 10.1007/s44438-026-00040-4

Keywords: cybersecurity, smart grid, distributed energy resources, FERC Order No. 893, NERC CIP standards, Gordon-Loeb model, real options analysis, utility capital allocation, carbon-neutral grid, renewable energy integration, grid reliability, investment framework