The Cybersecurity Accelerator Program, or CAP, helps public power utilities to assess and improve the maturity of their cybersecurity programs. This includes assessing both information technology and operational technology cybersecurity posture as well as the policies and practices that support electric system and grid security.
Through the program questionnaire, utilities can assess their adherence to fundamental cybersecurity practices across four main categories:
- Internal controls: the processes, practices, and technical safeguards that are essential for maintaining the confidentiality, integrity, and availability of your networks and data.
- Cybersecurity governance and training: the roles, responsibilities, structure, and resources that guide an organization’s security strategy, provide accountability, and ensure employees follow secure practices.
- Cyber incident response: the structured processes and procedures organizations use to detect, contain, and recover from cybersecurity events.
- Cyber risk management: the process of identifying, assessing, prioritizing, and mitigating risks to critical systems and data to reduce the likelihood and impact of cyber incidents.
CAP Designation
Utilities that demonstrate implementation of core cybersecurity practices across these areas receive recognition from APPA as diamond, platinum, or gold-level CAP designees. Gold designations go to utilities that demonstrate core cybersecurity practices. Platinum designations go to utilities that demonstrate cybersecurity programs well above core practices. Diamond designations go to utilities that demonstrate cybersecurity programs above and beyond core practices.
The CAP assessment is intended to not only recognize utilities who have mature cyber programs, but to demonstrate what such a program might look like to utilities who are less advanced. CAP designation is only one milestone on a journey of cyber program maturity that will continue to evolve in line with advancements in cyber threats and vulnerabilities.
How to Apply
Utilities must first complete a registration form to be granted access to the online application. The individual designated as the utility’s primary contact on this form will be the primary point of contact for all correspondence relating to the application. As the assessment covers many operational areas, utilities are encouraged to review the questions in advance to determine what information they will need to complete the assessment, and who needs to be involved in the process. APPA recommends that applicants work with both leadership and subject matter experts within their organization to complete the self-assessment. The application guide includes the assessment questions and supporting information.
CAP is currently funded through APPA’s Cyber Pathways program, under a cooperative agreement with the Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response. There is no application fee while CAP is part of the Cyber Pathways program.
Utilities must submit the application, including program checklists, supplemental information and/or documentation as necessary, by June 30.
Utilities may only submit one CAP application per year. While CAP designations are valid for two years, utilities that receive a CAP designation may reapply in the middle of the cycle if they desire.
Timeline Overview
- Application period: March 30-June 30, 2026
- CAP panel reviews and scores applications: July 2026
- Scoring adjustment/Reconsideration period: August 2026
- Designations announced for 2026-2028: September 2026 (at the Cybersecurity and Technology Summit)
CAP Panel
The CAP is governed by a 10-person panel, consisting of representatives from member utilities, joint action agencies, and state/regional associations. The panel makes key decisions on program direction and reviews applications from potential designees. Individuals affiliated with APPA members can nominate people to participate in the CAP panel as positions become available.