Runs an essential service, in Alberta

CIP-008-AB-5 · Read the law's page

• If you are a Responsible Entity listed in section 4.1, such as the operator or legal owner of a generating unit or of a transmission facility, or the legal owner of an electric distribution system that owns the protection or restoration facilities listed in section 4.1.2, document one or more cyber security incident response plans for your high impact and medium impact BES cyber systems that include a process to identify, classify and respond to cyber security incidents, the roles and responsibilities of response groups or individuals, and incident handling procedures (R1, Table R1 parts 1.1, 1.3 and 1.4).
• Include in each plan a process to determine whether an identified incident is a reportable cyber security incident and to notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law, with an initial notice, which may be only a preliminary notice, no more than one hour after you determine that it is reportable (R1, Table R1 part 1.2).
• Test each plan at least once every 15 months, by responding to an actual reportable incident, a paper drill or tabletop exercise, or an operational exercise, and retain records related to a reportable cyber security incident (R2, Table R2 parts 2.1 and 2.3).
• When you respond to a reportable cyber security incident or perform an exercise of one, use the plan, and document the deviations from it taken during the response or exercise (R2, Table R2 part 2.2).
• No later than 90 days after a test or an actual reportable incident response, document the lessons learned or the absence of any, update the plan and notify each person or group with a defined role in it (R3, Table R3 part 3.1).
• No later than 60 days after a change to roles or responsibilities, response groups or individuals, or technology that you determine would impact your ability to execute the plan, update the plan and notify each person or group with a defined role in it (R3, Table R3 part 3.2).

Alta. Reg. 84/2024 · Read the law's page

• If you are the licensee or approval holder of a critical facility, meaning a coal processing plant, in situ operation, mine, mining operation, pipeline, processing plant or well that the Alberta Energy Regulator has named in its critical infrastructure list, establish and implement a security management program for the facility in accordance with CSA Z246.1 (s. 3(1)).
• File with the Regulator all or any specified information about the facility's security management when it requires it (s. 3(3)).

S.A. 2003, c. E-5.1, ss. 20.8, 21.1, 142(1)(l.1) · Read the law's page

• If you are an electricity market participant, comply with the reliability standards, which include the cyber security standards CIP-002 to CIP-013 and the physical security standard CIP-014 that the Alberta Electric System Operator lists as current; each standard states the entities and facilities it applies to (s. 20.8).