PUC Advances Proposed Cybersecurity Regulations for Pennsylvania Utilities

PUC Advances Proposed Cybersecurity Regulations for Pennsylvania Utilities

Published on 6/18/2026

Filed under: Electric Gas Motor Carrier Pipeline Rails Telecommunications Transportation and Safety Water and Wastewater

Proposal Would Strengthen Cybersecurity Standards, Incident Reporting, and Utility Preparedness Across Regulated Industries

HARRISBURG - The Pennsylvania Public Utility Commission (PUC) today voted 5-0 to approve a Notice of Proposed Rulemaking (NOPR) that would strengthen cybersecurity requirements for regulated utilities, continuing the Commission's efforts to help protect critical utility infrastructure and maintain safe, reliable service for Pennsylvania consumers.

The proposed regulations would modernize and expand the Commission's existing cybersecurity framework, establishing updated standards for utility cybersecurity programs, enhancing cybersecurity incident reporting requirements, and requiring annual certifications of compliance by jurisdictional utilities.

"Cybersecurity is a fundamental part of both utility reliability and public safety," said PUC Chairman Steve DeFrank. "As utilities increasingly rely on interconnected technologies to provide essential services, it is important that our regulatory framework continues to evolve alongside emerging threats. This proposal reflects a thoughtful, comprehensive approach that seeks to strengthen utility preparedness while providing stakeholders an opportunity to help shape the final regulations."

Strengthening Utility Cybersecurity

Today's action represents the latest step in an ongoing Commission review of utility cybersecurity regulations, building on stakeholder input gathered through earlier proceedings and reflecting the evolving nature of cybersecurity threats facing critical infrastructure across the nation.

The proposed regulations would require utilities to maintain cybersecurity programs aligned with widely recognized national cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The proposal also establishes updated requirements for cybersecurity evaluations, incident reporting, and annual certifications designed to help ensure utilities maintain appropriate cybersecurity practices based on the size and complexity of their operations.

In addition, the proposed rulemaking would consolidate and modernize cybersecurity incident reporting requirements, creating a more consistent framework for notifying the Commission of significant cybersecurity events that could affect utility operations or service reliability.

Recognizing that some utilities may already operate under comparable or more rigorous cybersecurity requirements, the proposal includes a process for utilities to seek waivers when they can demonstrate compliance with equivalent standards that provide an appropriate level of cybersecurity protection.

Cybersecurity has become an increasingly important component of utility operations as critical infrastructure systems continue to rely on interconnected digital technologies. The Commission's proposal is intended to strengthen preparedness, improve situational awareness, and support the continued delivery of safe and reliable utility service throughout the Commonwealth.

Comments on the Proposed Rulemaking

Following publication of the proposed rulemaking in the Pennsylvania Bulletin, interested stakeholders will have the opportunity to participate in the formal rulemaking process:

• Written comments may be filed within 90 days of official publication in the Pennsylvania Bulletin.
• Reply comments may be filed within 45 days following the initial comment period.
  
  

Additional information about submitting public comments will be provided when the NOPR has been published and the official comment period has begun.

The proposed rulemaking will also be reviewed by the Independent Regulatory Review Commission (IRRC) and relevant Legislative Standing Committees, consistent with Pennsylvania's regulatory review process.

About the PUC

The Pennsylvania Public Utility Commission balances the needs of consumers and utilities; ensures safe and reliable utility service at reasonable rates; protects the public interest; educates consumers to make independent and informed utility choices; furthers economic development; and fosters new technologies and competitive markets in an environmentally sound manner.

Visit the PUC's website at puc.pa.gov for recent news releases and video of select proceedings. You can also follow us on X, Facebook, LinkedIn, Instagram and YouTube. Search for the "Pennsylvania Public Utility Commission" or "PA PUC" on your favorite social media channel for updates on utility issues and other helpful consumer information.

# # #

Docket No.: L-2022-3034353

Contact:

• Nils Hagen-Frederiksen
  Press Secretary
  717-418-2701
  [email protected]
• David Hixson
  Deputy Press Secretary
  717-772-2766
  [email protected]