ED · 10-Q · 2026Q3 · Full report
Cybersecurity Regulatory Compliance
CONSOLIDATED EDISON INC · 2026-11-05 · Importance 40 · Surprise 42 · In source text
In April 2026, the NYSPSC adopted cybersecurity regulations for New York utilities, effective June 1, 2026, with phased compliance periods of up to 18 months for certain requirements. The rules require a risk-based program aligned with the NIST Cybersecurity Framework, including governance, assessments, audits, monitoring, incident response, and recovery planning, as well as prompt incident reporting and customer credit monitoring after certain breaches. Incremental compliance costs, including capital expenditures, may be deferred and reviewed in future rate proceedings. The Utilities say they already meet many requirements and expect to comply within the prescribed timeframe.
Key facts
- New York utility cybersecurity regulations adopted in April 2026 became effective June 1, 2026, with phased compliance periods of up to 18 months for certain requirements. source
- Cybersecurity-regulation incremental costs, including compliance capital expenditures, are subject to deferral and review in future rate proceedings. source
Impact estimates
| metric | direction | stage | expected | basis |
|---|---|---|---|---|
| operating_income | negative | contingent | — | New York utility cybersecurity regulations adopted in April 2026 became effective June 1, 2026, with phased compliance periods of up to 18… |