RIIO-ED3: When cybersecurity competes for capital
For UK electricity Distribution Network Operators (DNOs), every investment comes with a trade-off. Under RIIO-ED3, cybersecurity is becoming an increasingly important part of that equation.
Consider the choices facing network planners. Do you prioritise replacing an ageing asset, reinforcing network capacity or addressing a cybersecurity vulnerability in operational technology? Each investment responds to a different risk, but all compete for limited capital and delivery resources.
As cyber threats evolve, particularly with AI-enabled attacks and growing exposure across legacy infrastructure, these decisions are becoming harder to separate.
Compliance is the floor
Traditional approaches often treat cyber expenditure separately from wider asset investment planning. But cyber vulnerabilities can directly affect network reliability, operational continuity and the value of existing infrastructure.
As threats become more sophisticated, particularly with the emergence of AI-enabled attacks and vulnerabilities in legacy operational technology, DNOs need to consider cyber exposure as part of the wider investment picture.
This creates a broader investment planning challenge. How can DNOs demonstrate the value of cybersecurity expenditure alongside investments in reliability, safety and network modernisation?
The answer lies in evaluating cyber risk alongside safety, reliability, cost and other business priorities, using a consistent framework to understand where investment delivers the greatest value.
Making every investment defensible
With RIIO-ED3 introducing clearer expectations for cyber resilience planning and investment justification, the ability to demonstrate these trade-offs becomes increasingly important.
In his latest perspective, Jeff Pauska, VP Product Management at IFS Copperleaf, explores how the changing cyber threat landscape intersects with RIIO-ED3 requirements, and why DNOs may need to rethink how cyber risk is valued within their capital plans.
He examines what Ofgem’s decisions mean for investment planning, the changes needed in value frameworks and the questions network leaders should be asking as they prepare to defend their plans.
Compliance is the floor. What matters next is how every investment earns its place.