Runs an essential service, in Ontario

Ontario Cyber Security Standard, Parts 3 to 5 (Version 3.1); Transmission System Code, s. 3B.2.4; Distribution System Code, s. 6.8.3 · Read the law's page

• It reaches you if you declare that you operate an essential service and you hold an Ontario electricity transmitter or distributor licence, because compliance with the Transmission System Code and the Distribution System Code is a licence condition.
• Participate in the IESO's Lighthouse service: sign the IESO's participation agreement, be granted access to the Lighthouse Member Portal and establish a secure network connection with the Lighthouse infrastructure, and confirm your participation as the Ontario Energy Board requires (part 3).
• Implement the Cyber Security Framework control objectives that part 4.1 lists at maturity indicator level 2 and those that part 4.2 lists, and report on their implementation (part 4).
• Obtain an independent assessment on the schedule the Ontario Energy Board sets, from an independent assessor who meets the minimum qualifications in part 5.1 (a), and have the assessor assess your maturity indicator level for each control objective (part 5.1).
• Have the assessor and your Chief Executive Officer sign and date the assessment report, and submit it to the Ontario Energy Board signed by the Chief Executive Officer on or before the reporting deadline (part 5.1 (c) and (d)).
• If the Ontario Energy Board requires it after reviewing the report, submit an action plan with the steps you intend to take on the recommendations, including target maturity levels and timelines (part 5.2).

Ontario Cyber Security Standard, Part 6 (Version 3.1); Transmission System Code, s. 3B.2.4; Distribution System Code, s. 6.8.3 · Read the law's page

• It reaches you if you declare that you operate an essential service and you hold an Ontario electricity transmitter or distributor licence, because compliance with the Transmission System Code and the Distribution System Code is a licence condition.
• Notify the IESO of a confirmed cyber security incident by submitting a Cyber Security Incident Report through the Lighthouse Member Portal or to cybersecurity@ieso.ca by the end of the next business day after you confirm the incident (part 6.1 and Appendix 2).
• Complete the four questions on the report that decide whether it is a Notable Cyber Security Incident Report, which the IESO shares with the Ontario Energy Board (part 6.2).
• Submit a revised report by the end of the next business day after you learn new information that materially alters a report you already submitted (part 6.3).
• Answer an information request from the IESO or the Ontario Energy Board about the incident, including your security controls, processes and risks, within the timeline stated in the request (part 6.4).