Topic:"Cybersecurity" in M12780

pendix A, section 9.4 and in the Innovation Framework, Process and Plan for 2027–2031 included as Attachment 5 to Appendix A. Further discussion is also provided in Appendix A at sections 7.1 and 7.2. In response to the concerns regarding...

AI summary E1 excluded Residential Behaviour from its Preferred Plan due to cybersecurity issues affecting its My Efficiency Insights portal, limiting performance data to 12 months. The platform was deemed unsuitable for marketing due to design limitations, vendor constraints, and reporting delays, despite initial evaluation for repurposing.

2.2.2 RESIDENTIAL BEHAVIOUR PROGRAM - Residential Behaviour, re-introduced as a program component in the 2023–2026 Plan, experienced a - delayed launch with implementation beginning in Q2 2024. In 2023, E1 collaborated with NS Power to - a...

AI summary The Residential Behaviour Program, part of E1's 2023–2026 plan, faced delays, underperformance due to lower savings, and an indefinite pause in 2025 after a cybersecurity incident at NS Power. Savings fell below targets in 2024 and 2025, with the program removed from the 2027–2031 DSM Preferred Plan due to vendor and platform constraints.

8 7.2 CRITICAL PEAK PRICING OVERLAP 9 As part of ongoing collaboration on demand response, E1 and NS Power met in late 2024 to identify opportunities to strengthen coordination across demand response initiatives, including rate-based appro...

AI summary E1 and NS Power collaborated to address overlap between E1's demand response programs and NS Power's Time-Varying Pricing (TVP) rates, which target similar customers and peak periods. A 2025 cybersecurity incident paused the TVP pilot, returning participants to standard rates. Future DSM plans (2027–2031) expect minimal overlap, with ongoing efforts to coordinate locational demand response and avoid double-counting savings.

12 11. CONFIDENTIAL AND PERSONAL INFORMATION - 13 11.1 The Parties have executed or agree to execute the confidentiality agreement attached 14 hereto as Schedule "D" - Confidentiality ("Confidentiality Agreement"). - 15 11.2 EfficiencyOne...

AI summary The Parties have executed a confidentiality agreement (Schedule D), requiring EfficiencyOne to secure NSPI's personal information and indemnify NSPI against liabilities from misuse or disclosure, including CASL compliance.

11. CONFIDENTIAL AND PERSONAL INFORMATION - 6 11.1 The Parties have executed or agree to execute the confidentiality agreement attached 7 hereto as Schedule "D" - Confidentiality (" Confidentiality Agreement "). - 8 11.2 EfficiencyOne shal...

AI summary The document outlines a confidentiality agreement between EfficiencyOne and Nova Scotia Power Incorporated (NSPI), requiring EfficiencyOne to secure personal information and indemnify NSPI against liabilities from misuse or disclosure, in compliance with the Public Utilities Act and CASL.

d the Mi'kmaw Home Energy Efficiency Project (which, combined with the 3.5 GWh achieved in 2023 and the 5.3 GWh achieved in 2024 represents 84% progress towards the four-year Plan target of 19.8 GWh). During 2025 several programs underwent...

AI summary The Mi'kmaw Home Energy Efficiency Project achieved 84% progress toward its four-year target. In 2025, program transitions like Appliance Retirement and Green Heat closures, plus a cybersecurity incident at NS Power disrupting AMI data, caused underperformance. E1 aims to meet 90% compliance thresholds for 2023-2026 Plan targets, spending $236.8 million.

2025 and overall 2023-2025 spending being within the approved $173.0 million investment level; but also contributed to energy savings and demands savings coming in lower than the 2025 Plan targets. Demand savings for both E1's Residential...

AI summary The 2025 Plan's energy and demand savings fell below targets due to factors like NS Power's cybersecurity incident, program adjustments (e.g., LED measures removal), federal grant closures, and declining program efficacy. Residential Behaviour's energy savings dropped significantly, impacting overall results. Green Heat and Appliance Retirement programs ended due to sustained low savings.

1 Table 7: 2025 Existing Residential EXISTING RESIDENTIAL (2025) Existing Residential Energy Savings (GWh) Demand Savings (MW) Expenditure ($ million) 2025 Results 35.3 9.6 24.7 2025 Plan 60.6 10.2 23.6 - Existing Residential did not achie...

AI summary The 2025 Existing Residential program did not meet its energy savings targets due to the pause of the Residential Behaviour program component from May to December 2025, caused by a cybersecurity incident at NS Power and the unavailability of AMI customer data. This resulted in no energy savings being generated through this program component for eight months.

Residential Behaviour Highlights - Residential Behaviour achieved 5.6 GWh of energy savings between January and April before the program component was paused indefinitely in May due to a cybersecurity incident at NS Power that resulted in...

AI summary Residential Behaviour achieved 5.6 GWh savings before being paused indefinitely in May 2025 due to a NS Power cybersecurity incident disrupting AMI data transfer. E1 reduced costs and maintained readiness to resume operations. Ongoing communication with NS Power continues, but no data restoration timeline exists. E1 will address 2026 impacts in its mid-course adjustment, filed May 25, 2026.

CUSTOM INCENTIVES (2025) The Retrofit and Pay-for-Performance services also had some partial savings claims. [10](#page-34-0) The Retrofit and New Construction services accounted for most of the energy and demand savings achieved. - o The...

AI summary In 2025, Nova Scotia's Retrofit and New Construction services achieved significant energy savings, while Pay-for-Performance faced delays due to a cybersecurity incident at NS Power. The New Construction team is preparing for the 2020 NECB Tier 1 code adoption, with impacts expected by 2026-2027. Partial savings claims were reported across multiple programs.

DEMAND RESPONSE (2025) event participation reporting available within 48 hours of participation, and pre-event coordination support. - As a result of the NS Power cybersecurity incident, significant reconfiguration was required to run the...

AI summary The 2025/2026 BNI Demand Response program faced reconfiguration due to NS Power's cybersecurity incident, leading to independent metering and increased costs. E1 partnered with a new aggregator for enhanced metering and real-time data, resulting in early indications of doubled capacity compared to 2024/2025.

2.1.5 Effective Useful Life Review As part of the 2025 DSM MA update, the Evaluator only reviewed the EUL values for lighting measures and relied on previously established EUL values for other measures. Lighting measure EUL values were upd...

AI summary The 2025 DSM MA updated Effective Useful Life (EUL) values for lighting measures based on BNI market research, using a method that accounts for baseline evolution and equipment replacement timelines. A NS Power cybersecurity incident disrupted AMI data access after April 2025, impacting EUL calculations.

Residential Behaviour - › Residential Behaviour has been paused since May 2025 due to a cybersecurity incident at NS Power in spring 2025 whereby AMI data were no longer available. The evaluation was, therefore, limited to the four months...

AI summary Residential Behaviour program was paused in May 2025 due to a cybersecurity incident at NS Power, limiting evaluation to January-April 2025. Achieved 5.555 GWh savings, falling short of the planned 29.771 GWh.

28 Residential Behaviour Key Findings and Recommendations The main objective of the 2025 Residential Behaviour evaluation was as follows: › Calculate net results, namely electrical first-year energy savings as well as avoided GHG emissions...

AI summary The 2025 Residential Behaviour program was paused in May 2025 due to a cybersecurity incident at NS Power, limiting AMI data access. This resulted in only 5.555 GWh of net energy savings (vs. a target of 29.771 GWh) over four months (Jan-Apr 2025). High and medium electricity users achieved partial savings, while low users saw no statistically significant results.

Co ntr ol Ac tiv ity r 'I tan t' T ab of '2 02 2 B ER In ter l C tro l' F ile pe ns na on Ma ing pp C1 On nth ly ba sis the Ef fic ien Pa Dis trib r T lat n S ha reP oin t is vie d b P S cia list lid tha nly d b EN S a rtn uto to ate t o a...

AI summary The document discusses control activity related to the '2022 BER Interl Control' filing, mentioning the Efficient Point of Distribution (EPD) and the role of the PSC (Public Service Commission) in reviewing measures related to automation and cybersecurity.

Round 2 Model Input Assumptions and Results Board Directives E1 Update • To promptly identify any issues or potential issues relating to the impact of NS Power's cybersecurity incident on E1's operations and programming as they arise. • On...

AI summary The document outlines Round 2 model input assumptions and results, including Board Directives related to cybersecurity, the inclusion of PAC test results in annual reports, and updates to the DSM Plan. It also details collaboration with the DSM Advisory Group on avoided costs and cost-effectiveness testing methodologies.

Cybersecurity Incident: On April 25, 2025, NSPI discovered a cybersecurity incident (the "Cybersecurity Incident") involving unauthorized access into certain parts of its IT network and servers supporting portions of its business applicati...

AI summary On April 25, 2025, NSPI experienced a cybersecurity incident with unauthorized access to parts of its IT network, but no physical operations were disrupted. The company is managing the incident through business continuity processes and has recognized after-tax costs of $1 million in Q4 2025 and $7 million for the year ended December 31, 2025.

Class Action Lawsuit: NSPI was named as a defendant in a claim for a class action lawsuit filed with the Supreme Court of Nova Scotia, seeking damages arising from the Cybersecurity Incident. The amount of damages has not been specified. D...

AI summary NSPI is a defendant in a class action lawsuit filed in the Supreme Court of Nova Scotia related to a cybersecurity incident. The damages sought are unspecified, and the legal proceedings are in a preliminary stage, making it impossible to estimate potential losses.

Cybersecurity Risk NSPI is exposed to potential risks related to cyberattacks, data breaches, cyber-extortion, and unauthorized access that could result in a Material Adverse Effect. The Company increasingly relies on IT systems, networks...

AI summary NSPI faces cybersecurity risks from cyberattacks, data breaches, and unauthorized access, which could disrupt its critical energy infrastructure. The company relies on IT systems, third-party providers, and cloud infrastructure, increasing exposure to threats, especially from nation-state actors and evolving AI-based attacks.

Technology Risk NSPI relies on various technology systems to manage operations, including increasing reliance on IT solutions operated by third parties, such as software as a service and third party cloud hosting. This subjects NSPI to inh...

AI summary NSPI faces technology risks due to reliance on third-party IT systems, which may lead to operational disruptions, increased costs, and vulnerabilities to cyberattacks. The rapid evolution of AI could disrupt business models and pose risks if not integrated effectively. NSPI's digital transformation strategy involves significant investment in emerging technologies, increasing project risks.

Q2 2025 compared to Q2 2024 Q2 2025 net income decreased by $12 million compared to Q2 2024. The decrease is due to increased OM&G expenses, and increased depreciation and amortization due to increased PP&E in service. OM&G expenses increa...

AI summary Q2 2025 net income decreased by $12 million compared to Q2 2024, primarily due to increased OM&G expenses and depreciation and amortization from higher PP&E in service. Increased OM&G expenses were driven by higher power generation costs and expenses related to a Cybersecurity Incident.

g 6 the restoration of the AMI data transfer. - 8 Depending on the outcomes of the DER Integration Roadmap and AMI feeder ID 9 information, E1 would expect to assess the appropriate next steps. (g) 7 Request IR-55: Please refer to the disc...

AI summary The response discusses E1's awareness of NS Power's upcoming TVP 2024/25 EM&V report and the ongoing process for resolving cybersecurity and AMI data issues from the TVA pilot. E1 highlights the filing of Monthly Update 8 in matter M12273 regarding the cybersecurity incident.

12 Process Timeframe filing of the Annual Progress Report and Evaluation Report. Additional meetings scheduled throughout the year as required. 1 Request IR-90: 2 3 Please refer to Appendix A - Attachment 4, Sheet 21 (Annual Cost Category)...

AI summary The document outlines a request for detailed information on demand response enrollments, program costs, and energy savings across various years and customer segments. It also asks for a description of cost categories and a breakdown of costs related to a cybersecurity incident.

History. There was a serious cybersecurity incident affecting AMI data that required the program to pause in May 2025. This restricted the 2025 program evaluation to January-April 2025 data. Evaluation for 2025 was confined to AMI billing...

AI summary A cybersecurity incident in May 2025 caused a pause in the AMI program, limiting the 2025 evaluation to January-April data. The evaluation used a net savings approach and found 5,555 GWh. The results were included in portfolio calculations after regulatory review, and the evaluation methods were consistent with the 2024 evaluation.

, service to low-income and moderate-income customers, and social inclusion as well as benefit-cost analysis' allowable under current legislation and Board orders? ( italics added. ) - Response: - The Verification Team has no information o...

AI summary The document raises questions about the inclusion of certain factors in benefit-cost analysis for low-income and moderate-income customers, as well as the impact of a cybersecurity incident on program evaluations. The Verification Team notes a lack of independent analysis and suggests these issues should be addressed by EfficiencyOne or through broader regulatory analysis.

Economic and Policy Analysis Consumer Advocate – Nova Scotia (March 2019 – Present) - Member of DSM Advisory Group (DSMAG) on behalf of the Consumer Advocate of Nova Scotia to provide ongoing support for design and implementation of progra...

AI summary The Consumer Advocate of Nova Scotia has been actively involved in the design and implementation of demand-side management (DSM) programs, including providing analysis and testimony on various DSM Plans and studies. The Advocate has also commented on proposals related to time-varying pricing tariffs and service interruption due to cyberattacks.

ts that assessment of the data and appropriate solutions for priority constrained areas will be further explored with NS Power and through their work with stakeholders on the DER Integration Roadmap." - a. Please provide the current status...

AI summary The document includes requests related to the DER Integration Roadmap's status, timeline, stakeholder engagement, and AMI data feeds, as well as inquiries about the TVA pilot and cybersecurity/AMI data issues. Entities involved are E1 and NS Power.

pilot referenced in Appendix A – Preferred Plan. - b. Please explain E1's understanding of the expected timeline and process for resolving cybersecurity and AMI data issues associated with the pilot. Request IR-56: Please refer to Table 44...

AI summary The document includes information requests regarding the timeline for addressing cybersecurity and AMI data issues in a pilot program and the eligibility of interruptible customers for the BNI Demand Response program. E1 acknowledges past ineligibility of interruptible customers but is open to discussions about their inclusion in the 2027–2031 DSM Plan period.

sed), and 2031 (proposed) broken out by customer segment (Residential vs BNI), DR Option (battery, EV, hot water heaters, thermostats, curtailment, loadshift to BUGs, other – please add), and existing vs. new participants. Please break out...

AI summary The document requests detailed cost breakdowns for the 2027-2031 DSM plan, including segmentation by customer type, DR options, and cost categories. It also asks about cybersecurity incident costs, vendor contracts, and program delivery specifics. The request is filed by Synapse (E1) in a regulatory proceeding.

f identifiable individuals. It is E1's position that this material constitutes sensitive commercial and financial information, the disclosure of which could reasonably be expected to cause harm to E1. NSEB IR 19, Attachments 3 and 5, conta...

AI summary EfficiencyOne (E1) requests confidential handling of documents containing sensitive commercial and cybersecurity information, arguing disclosure could harm E1. The materials include KPMG assessments from NSEB IR 19, attachments 3 and 5, which E1 claims could jeopardize cyber assets if disclosed.

Request IR-6: Refer to Exhibit E-17, the Peach Report, page 53, which states: Inclusion in Portfolio Calculations . Although there was some discussion of exclusion of results from the portfolio realization rate calculation, the result foll...

AI summary The text includes two regulatory requests (IR-6 and IR-7) referencing the Peach Report. IR-6 seeks clarification on a regulatory review regarding portfolio energy savings inclusion. IR-7 addresses the impact of a cybersecurity incident on the 2025 Residential Behaviour program's evaluation, noting partial-year results due to program interruption. Questions focus on the incident's effects beyond data availability and the timeline of disruptions.

b) Cyber Security Measures discussed in OM&G costs In its Direct Evidence, Appendix 6A – OM&G Costs by Group, pages 19-20, NS Power claimed confidentiality over various cyber security measures it has undertaken. Ms. Rubin asserted that the...

AI summary NS Power claimed confidentiality over its cyber security measures in OM&G costs, arguing that disclosure could aid potential attackers. The Board acknowledged NS Power's obligation to protect critical infrastructure and agreed that the measures should remain confidential for public security reasons.