Runs an essential service, in Michigan

Electric Technical Standards, annual cybersecurity report, Mich. Admin. Code R 460.3205(1) · Read the law's page

• This binds an electric utility or cooperative electric utility subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.3101(1)).
• Provide a written or oral annual report, individually or jointly with other electric utilities or cooperatives, to designated members of the commission staff on your cybersecurity program and related risk planning (R 460.3205(1)(a)).
• Include in the report an overview of the program and your approach to cybersecurity awareness and protection, your cybersecurity awareness and specialized training and exercise participation in the previous calendar year, an organizational diagram with primary and secondary cybersecurity emergency contacts, your communications plan for unauthorized actions that cause loss of service, financial harm or a breach of sensitive data, a redacted summary of such actions that occurred, your risk assessment tools and methods, and general information about your current emergency response plans, threat assessments and vulnerability assessments (R 460.3205(1)(a)(i) to (vii)).
• If you are an electric utility rather than a cooperative, add to the annual report an overview of major cybersecurity investments in the previous calendar year (R 460.3205(1)(b)).

Electric Technical Standards, cybersecurity incident report, Mich. Admin. Code R 460.3205(2) · Read the law's page

• This binds an electric utility or cooperative electric utility subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.3101(1)).
• Orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center as soon as reasonably practicable and before public notification (R 460.3205(2)).
• Make that report if a person intentionally interrupted the production, transmission or distribution of electricity, extorted money or another thing of value from you through a cybersecurity attack, or caused a denial of service lasting more than 12 hours, or if a security breach as the identity theft protection act defines it occurred before public and customer notification (R 460.3205(2)(a) to (d)).
• You may also make the report, at your discretion, for any other cybersecurity incident, attack or threat that you deem notable, unusual or significant (R 460.3205(2)(e)).
• Do not make the oral report where law or a court order prohibits it or official law enforcement personnel instruct otherwise (R 460.3205(2)).

Gas Technical Standards, annual cybersecurity report, Mich. Admin. Code R 460.2324(1) · Read the law's page

• This binds a gas utility that operates in Michigan and is subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.2302(1)).
• Provide a written or oral annual report, individually or jointly with other utilities, to designated members of the commission staff on your cybersecurity program and related risk planning (R 460.2324(1)(a)).
• Include in the report an overview of the program and your approach to cybersecurity awareness and protection, your cybersecurity awareness and specialized training and exercise participation in the previous calendar year, an organizational diagram with primary and secondary cybersecurity emergency contacts, your communications plan for unauthorized actions that cause loss of service, financial harm or a breach of sensitive data, a redacted summary of such actions that occurred, your risk assessment tools and methods, and general information about your current emergency response plans, threat assessments and vulnerability assessments (R 460.2324(1)(a)(i) to (vii)).
• If you are an investor-owned public utility, add to the annual report an overview of major cybersecurity investments in the previous calendar year and the plans and rationale for those anticipated for the next calendar year (R 460.2324(1)(b)).

Gas Technical Standards, cybersecurity incident report, Mich. Admin. Code R 460.2324(2) · Read the law's page

• Orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center as soon as reasonably practicable and prior to any public notification (R 460.2324(2)).
• Make that report if a person intentionally interrupted the production, transmission or distribution of natural gas, extorted money or another thing of value from you through a cybersecurity attack, or caused a denial of service lasting more than 12 hours, or if a security breach as the identity theft protection act defines it occurred before public and customer notification (R 460.2324(2)(a) to (d)).
• You may also make the report, at your discretion, for any other cybersecurity incident, attack or threat that you deem notable, unusual or significant (R 460.2324(2)(e)).
• Do not make the oral report where law or a court order prohibits it or official law enforcement personnel instruct otherwise (R 460.2324(2)).
• This binds a gas utility that operates in Michigan and is subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.2302(1)).