Runs an essential service, in the United States

NRC cyber security requirements for nuclear power plants, 10 CFR 73.54 · Read the law's page

• This instrument reaches your organization only if it is a licensee licensed to operate a nuclear power plant under part 50 of 10 CFR, or an applicant for an operating or combined license who is required to include a cyber security plan. Declare operates_essential_service where that holds; the Commission licenses these plants as critical infrastructure and no role names a nuclear licensee more closely.
• Submit a cyber security plan that satisfies section 73.54 for Commission review and approval, with a proposed implementation schedule, and implement your cyber security program consistent with the approved schedule.
• Provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat.
• Protect the digital computer and communication systems and networks associated with safety-related and important-to-safety functions, security functions, emergency preparedness functions, and the support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.
• Establish, implement, and maintain a cyber security program as a component of the physical protection program, designed to implement security controls, apply defense-in-depth protective strategies to detect, respond to, and recover from cyber attacks, and mitigate their adverse effects.
• Conduct cyber security event notifications in accordance with section 73.77, include measures for incident response and recovery for cyber attacks in the cyber security plan, and retain records until the Commission terminates the license for which they were developed.

NRC cyber security event notifications, 10 CFR 73.77 · Read the law's page

• This instrument reaches your organization only if it is a licensee subject to the cyber security requirements of 10 CFR 73.54 or 10 CFR 73.110, meaning a licensee of a nuclear power plant under part 50 or 52, or a commercial nuclear plant licensee under part 53 that elects to implement section 73.110. Declare operates_essential_service where that holds; the Commission licenses these plants as critical infrastructure and no role names a nuclear licensee more closely.
• Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions. Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
• Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
• Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
• Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.

NERC Reliability Standard CIP-008-6 (16 U.S.C. 824o) · Read the law's page

• This standard reaches your organization only if it is a balancing authority, reliability coordinator, transmission operator or owner, generator operator or owner, or a distribution provider that owns specified protection or restoration facilities, and it has BES Cyber Systems categorized as high impact or medium impact. Declare operates_essential_service where that holds; no role names an operator of the bulk electric system more closely.
• Document one or more Cyber Security Incident response plans that include a process to identify, classify and respond to Cyber Security Incidents, criteria to evaluate and define attempts to compromise, a process to determine whether an incident is a Reportable Cyber Security Incident or an attempt to compromise, and a process to give the notifications Requirement R4 requires.
• Notify the Electricity Information Sharing and Analysis Center and, if you are subject to the jurisdiction of the United States, the National Cybersecurity and Communications Integration Center or its successor, of a Reportable Cyber Security Incident and of a Cyber Security Incident that was an attempt to compromise a system in scope, unless prohibited by law.
• Give the initial notification within one hour after the determination of a Reportable Cyber Security Incident, and by the end of the next calendar day after the determination that a Cyber Security Incident was an attempt to compromise a system in scope.
• Include in each notification, to the extent known, the functional impact, the attack vector used and the level of intrusion that was achieved or attempted, and provide updates within 7 calendar days of determination of new or changed attribute information.

NERC Reliability Standard CIP-013-2 (16 U.S.C. 824o) · Read the law's page

• This standard reaches your organization only if it is a balancing authority, reliability coordinator, transmission operator or owner, generator operator or owner, or a distribution provider that owns specified protection or restoration facilities, and it has BES Cyber Systems categorized as high impact or medium impact. Declare operates_essential_service where that holds; no role names an operator of the bulk electric system more closely. A vendor that sells software or services to such an entity is not bound by the standard itself and meets it through the buyer's procurement process.
• Develop one or more documented supply chain cyber security risk management plans for your high and medium impact BES Cyber Systems and their associated Electronic Access Control or Monitoring Systems and Physical Access Control Systems, including processes to identify and assess the cyber security risk of vendor products and services you procure and install and of transitions from one vendor to another.
• Include in the processes you use to procure those systems the vendor's notification of vendor-identified incidents, coordination of responses to them, notification when remote or onsite access should no longer be granted, disclosure of known vulnerabilities, verification of the integrity and authenticity of software and patches, and coordination of vendor-initiated remote access, as applicable.
• Implement the plans, without renegotiating or abrogating existing contracts, and review them and obtain approval of the CIP Senior Manager or a delegate at least once every 15 calendar months.

Coast Guard Cybersecurity in the Marine Transportation System, 33 CFR 101.600 to 101.650 · Read the law's page

• This instrument reaches your organization only if it owns or operates a U.S.-flagged vessel, a facility or an Outer Continental Shelf facility that is required to have a security plan under 33 CFR parts 104, 105 or 106; it does not apply to foreign-flagged vessels subject to 33 CFR part 104. Declare operates_essential_service where that holds, since the Coast Guard sets these requirements to safeguard the security and resilience of the Marine Transportation System.
• Ensure a Cybersecurity Plan is developed, approved, and maintained, and submit it for review and approval to the cognizant Captain of the Port, Officer in Charge, Marine Inspections or Marine Safety Center; the plan is sensitive security information.
• Designate in writing, by name and by title, a Cybersecurity Officer who is accessible to the Coast Guard 24 hours a day, 7 days a week.
• Ensure the development, approval, and execution of a Cyber Incident Response Plan, and have the Cybersecurity Officer ensure an audit of the Cybersecurity Plan and its implementation is performed annually, beginning no later than 1 year from the initial date of approval.
• Ensure that multifactor authentication is implemented on password-protected IT systems and remotely accessible OT systems, and when it is not feasible, that appropriate compensating security controls are implemented and documented.
• Ensure all personnel with access to the IT or OT systems, including contractors, have cybersecurity training, and ensure cybersecurity drills are conducted at least twice each calendar year.

Coast Guard reportable cyber incident reporting, 33 CFR 101.620(b)(7) and 101.615 · Read the law's page

• This instrument reaches your organization only if it owns or operates a U.S.-flagged vessel, a facility or an Outer Continental Shelf facility that is required to have a security plan under 33 CFR parts 104, 105 or 106; it does not apply to foreign-flagged vessels subject to 33 CFR part 104. Declare operates_essential_service where that holds, since the Coast Guard sets these requirements to safeguard the security and resilience of the Marine Transportation System.
• If your organization has not reported to the Coast Guard pursuant to, and is not subject to, 33 CFR 6.16-1, ensure all reportable cyber incidents are reported to the National Response Center.
• Treat as a reportable cyber incident an incident that leads to or, if still under investigation, could reasonably lead to a substantial loss of confidentiality, integrity, or availability of a covered information system, network, or OT system, a disruption or significant adverse impact on your ability to engage in business operations or deliver goods or services, disclosure or unauthorized access to nonpublic personal information of a significant number of individuals, other potential operational disruption to critical infrastructure systems or assets, or an incident that otherwise may lead to a transportation security incident.
• Have the Cybersecurity Officer ensure all reportable cyber incidents are recorded and reported to the owner or operator, and include cyber incident reporting procedures in the Cybersecurity Plan.
• Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.

6 U.S.C. 681-681g (CIRCIA) · Read the law's page

• Where your organization is a covered entity in one of sixteen critical-infrastructure sectors, a status the statute leaves to a final rule to define, the covered cyber incident report, the ransom payment report, the supplemental report, and the data-preservation duty in 6 U.S.C. 681b(a) apply from the dates that final rule prescribes; declare operates_essential_service if your organization is a designated critical-infrastructure operator, since the Agency's April 2024 proposal would define that class by a small-business size threshold or a sector-specific criterion rather than by anything a general software or AI vendor does. The Cybersecurity and Infrastructure Security Agency had not issued that final rule as of September 20, 2026.
• Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
• Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
• Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
• A cloud service provider or managed service provider whose own compromise caused the impact at one of your customers is not, by virtue of that fact alone, a covered entity required to report; the duty runs to the covered entity whose systems were affected, unless the provider independently meets the covered-entity criteria in its own right.