PUC Highlights Growing Importance of Cybersecurity in Protecting Pennsylvania's Essential Utility Services

Published on 10/22/2026

Filed under: Electric Gas Pipeline Telecommunications Water and Wastewater

During Cybersecurity Awareness Month, Commission emphasizes stronger safeguards and utility preparedness to address evolving digital threats

HARRISBURG - As cyber threats continue to evolve and critical infrastructure becomes increasingly interconnected, the Pennsylvania Public Utility Commission (PUC) is marking National Cybersecurity Awareness Month by emphasizing the importance of protecting the systems that deliver essential utility services to millions of Pennsylvanians.

Throughout October, Cybersecurity Awareness Month highlights the importance of stronger digital security, greater awareness of potential threats and shared responsibility for protecting critical infrastructure, businesses and consumers.

For Pennsylvania's electric, natural gas, water, wastewater and telecommunications utilities, cybersecurity is an essential part of maintaining safe and reliable service.

"Cybersecurity is about much more than protecting computers and information - it's about protecting the essential services that Pennsylvania families, businesses and communities depend on every day," noted PUC Commissioner Kathryn L. Zerfuss. "As our utility systems become more sophisticated and interconnected, we must be equally focused on identifying emerging risks, strengthening defenses and preparing for potential disruptions. The consequences of a cyberattack can extend well beyond the digital world, making cybersecurity a fundamental part of utility reliability and public safety."

Strengthening Cybersecurity Oversight

The PUC continues to advance efforts to strengthen cybersecurity preparedness and accountability among regulated utilities.

In June 2026, the Commission unanimously approved a Notice of Proposed Rulemaking aimed at modernizing cybersecurity requirements for regulated utilities and establishing a more consistent framework for addressing cyber risks.

The proposal includes cybersecurity programs aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, consolidated incident reporting requirements, annual compliance certifications and provisions for regulatory review.

These proposed changes are intended to strengthen utility preparedness, improve consistency in cybersecurity practices and enhance the Commission's ability to evaluate and address potential vulnerabilities.

The Commission has also issued a series of cybersecurity advisories, alerting utilities to emerging threats, encouraging protective measures and reinforcing the importance of coordination with state and federal cybersecurity partners.

Cybersecurity and Critical Infrastructure

Cybersecurity threats present unique challenges for public utilities because attacks can affect not only business information systems, but also the operational technology used to monitor and control essential infrastructure.

A successful cyberattack could potentially disrupt utility operations, interfere with equipment or affect the delivery of services that are vital to public health, safety and economic activity.

The PUC continues to encourage utilities to assess cybersecurity risks, protect critical systems, maintain effective incident-response plans and strengthen coordination with cybersecurity and public safety partners.

These efforts include collaboration and information sharing with organizations such as the federal Cybersecurity and Infrastructure Security Agency (CISA), law enforcement agencies, utility industry groups and other state and federal partners.

Building a Stronger Cybersecurity Culture

Cybersecurity Awareness Month also serves as a reminder that effective protection depends on the actions of organizations and individuals.

The PUC encourages utilities and their employees to remain vigilant by following established cybersecurity practices, including:

• Strengthening access controls through multifactor authentication, secure passwords and careful management of system access.
  
  
• Protecting critical systems by maintaining updated software, addressing known vulnerabilities and limiting unnecessary external connections.
  
  
• Preparing for potential incidents through regular training, emergency planning and coordination with cybersecurity partners.
  
  
• Recognizing and reporting suspicious activity to help identify potential threats before they escalate.

Consumers can also take simple steps to protect themselves online, including using strong passwords, enabling multifactor authentication, keeping devices updated and remaining alert to suspicious emails, messages and requests for personal information.

"Cybersecurity is not something we can address once and consider finished," Commissioner Zerfuss added. "It requires continuous attention, investment and cooperation. By working together to strengthen preparedness and resilience, we can better protect the utility services Pennsylvanians count on - today and into the future."

Additional cybersecurity resources and guidance are available through CISA at www.cisa.gov/cybersecurity-awareness-month.

About the PUC

The Pennsylvania Public Utility Commission balances the needs of consumers and utilities; ensures safe and reliable utility service at reasonable rates; protects the public interest; educates consumers to make independent and informed utility choices; furthers economic development; and fosters new technologies and competitive markets in an environmentally sound manner.

Visit the PUC's website at puc.pa.gov for recent news releases and video of select proceedings. You can also follow us on X, Facebook, LinkedIn, Instagram and YouTube. Search for the "Pennsylvania Public Utility Commission" or "PA PUC" on your favorite social media channel for updates on utility issues and other helpful consumer information.

# # #

Contact:

• Nils Hagen-Frederiksen
  Press Secretary
  717-418-2701
  [email protected]