Runs an essential service, in New Jersey

Utility Cyber Security Incident Reporting, N.J. Board of Public Utilities Docket No. A016030196 Order (March 18, 2016), requirement 3 · Read the law's page

• Report to the Board's Reliability and Security Division staff, through the New Jersey Cybersecurity and Communications Integration Cell, within 6 hours of detection, any person accessing an industrial control system without authorization or exceeding authorized access, any unauthorized programs, information, code or commands discovered on an industrial control system, and any extortion of money or other thing of value by threatening damage to an industrial control system.
• Report to the Division staff, through the Cell, unusual cyber activity that has the potential to compromise critical systems and for which controls are ineffective.
• Copy the Division staff on notifications to New Jersey law enforcement agencies about information breaches involving customers' personally identifiable information, to the extent State law requires those notifications.
• Applies to the electric, natural gas, and water and wastewater utilities the order names; declare operates_essential_service where you operate such a utility.

Utility Cyber Security Program Requirements Order, N.J. Board of Public Utilities Docket No. A016030196 (March 18, 2016) · Read the law's page

• Applies to the electric, natural gas, and water and wastewater utilities the order names; declare operates_essential_service where you operate such a utility.
• Maintain a Cyber Security Program that defines and implements organizational oversight, accountabilities and responsibilities for cyber risk management and establishes policies, plans, processes and procedures for identifying and mitigating risk to your industrial control systems and to customer information systems that contain personal information as defined at N.J. Stat. Ann. 56:8-161.
• Annually inventory critical systems and assess and prioritize cyber risks to them, implement administrative, technical and compensating controls, and annually review the risk assessment methodology.
• Monitor log files of critical systems, monitor threat and vulnerability information sources including vendor and industry information-sharing advisories, and review vendor security patches in a timely manner.
• Establish a Cyber Security Incident Response Plan that includes log file retention protocols, and test it with an exercise at least once every 24 calendar months.
• Develop and implement a cyber security awareness program, reviewed biannually, and training for individuals with access credentials to industrial control systems and for administrators of customer information systems that contain personal information.
• Meet all requirements other than the initial steps no later than October 1, 2017, and certify compliance each year, signed by executive-level personnel with authority for the program; a certification of compliance with the NERC CIP standards suffices for critical systems subject to them.

N.J. Stat. Ann. 58:31-2, 58:31-4 and 58:31-4.1 (P.L. 2017, c.133, as amended by P.L. 2021, c.262) · Read the law's page

• Develop a cybersecurity program, in accordance with the requirements of the New Jersey Cybersecurity and Communications Integration Cell, that defines and implements accountabilities and responsibilities for cyber risk management and establishes policies, plans, processes and procedures for identifying and mitigating cyber risk to the water system.
• In that program, identify the individual chiefly responsible for executing it, conduct risk assessments and implement appropriate controls, maintain situational awareness of cyber threats and vulnerabilities, and create and exercise incident response and recovery plans.
• Update the program to apply to all of the water system's industrial control systems and to reasonably conform to the most recent version of the NIST Cybersecurity Framework, the CIS Critical Security Controls, or the ISO and IEC 27000 family of standards, and when a framework revision is published revise the program and submit it to the Cell no later than 180 days after publication.
• Submit a copy of the program to the Cell, join the Cell and create a cybersecurity incident reporting process, and obtain a cybersecurity insurance policy that meets any applicable standards the Board of Public Utilities adopts.
• Each year, submit to the Board of Public Utilities, the Department of Environmental Protection and the Cell a certification of compliance, signed by the responsible corporate officer of a privately held system, the executive director of an authority, or the mayor or chief executive officer of a municipally owned system.
• On the request of the Board, the Department or the Cell, provide proof of compliance in the form and manner they determine.
• Applies to a water purveyor, meaning any person that owns a public community water system with more than 500 service connections; declare operates_essential_service where you own and operate such a system.

N.J. Stat. Ann. 58:31-4.2 (P.L. 2021, c.262, section 4) · Read the law's page

• Applies to a water purveyor, meaning any person that owns a public community water system with more than 500 service connections; declare operates_essential_service where you own and operate such a system.
• Report to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of the incident and in accordance with all applicable laws, rules and regulations, any cybersecurity incident that compromises the confidentiality, integrity, availability or privacy of your utility billing, communications, data management or business information systems or the information on them.
• Report to the Cell, on the same clock, any cybersecurity incident against your industrial control system, including monitoring, operations and centralized control systems, that adversely impacts, disables or manipulates infrastructure, resulting in loss of service, contamination of finished water or damage to infrastructure.
• After the Cell causes an audit of your cybersecurity program and your response to a reported incident, submit the audit and any corrective action plans derived from it to the Cell; the audit is conducted by a qualified and independent cybersecurity company at your expense.