# Utilities Prioritize Cybersecurity Investments

A 2026 research paper proposes a four-part framework for utilities planning cybersecurity capital: treat mandatory NERC CIP work as a fixed compliance floor, screen discretionary projects against expected-loss benchmarks, stage investments with uncertain outcomes, and rank qualifying projects using financing incentives under FERC Order No. 893. The paper reports that no utility has applied for the Order No. 893 incentive and identifies cybersecurity services for distribution-connected energy resources, monitoring, and pilot deployments as potential market areas; it describes no active solicitation or contract opportunity.

- Utilities must account for NERC CIP work as a baseline compliance expense, while evaluating discretionary projects against expected losses.
- Companies offering cybersecurity services, monitoring, or pilot deployments for distribution-connected energy resources can assess how their offerings align with the investment areas identified in the paper.
- Procurement teams should distinguish this planning framework from a live buying opportunity: the paper reports no incentive applications and identifies no solicitation or award.

**Jurisdictions:** federal
**Industries:** Energy & Utilities
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 28, 2026

### Government Entities
- Federal Energy Regulatory Commission (FERC)
- North American Electric Reliability Corporation (NERC)

### Sources
- [A four-step framework for utility cybersecurity spending on the](https://bioengineer.org/a-four-step-framework-for-utility-cybersecurity-spending-on-the-carbon-neutral-grid) - Bioengineer.org