ED · 10-Q · 2026Q2 · Full report

Cybersecurity Regulatory Compliance

CONSOLIDATED EDISON INC · 2026-08-06 · Importance 44 · Surprise 60

The NYSPSC adopted cybersecurity regulations for New York utilities in April 2026, effective June 1, 2026, covering CECONY and O&R. The rules require a risk-based cybersecurity program aligned with the NIST Cybersecurity Framework, including governance, risk assessments, audits, monitoring, security controls and incident response and recovery planning. They also require prompt reporting to the NYSDPS, investigation of incidents, reporting of third-party vendor breaches and credit monitoring for customers after certain breaches. Compliance will be phased in, with incremental operating and capital costs eligible for deferral and review in future rate proceedings.