Runs an essential service, in Oklahoma

OAC 165:35-33, electric utility homeland security and critical infrastructure rules · Read the law's page

• This binds a electric utility serving Oklahoma jurisdictional ratepayers under the Corporation Commission's rules, which you declare by stating that you operate an essential service.
• Follow the most current applicable North American Electric Reliability Corporation's (NERC's) Security Guidelines and Standards or an equivalent cybersecurity framework as guidelines for protecting your critical infrastructure from extended service interruption.
• Prepare and make available for inspection a Homeland Security and Critical Infrastructure Plan, marked Highly Sensitive Confidential, that designates your critical infrastructure facilities, sets out the measures to secure them and follows that framework with a defined cybersecurity strategy.
• If you seek to recover security costs from Oklahoma jurisdictional ratepayers outside a general rate review, develop, implement and maintain a Critical Infrastructure and Security Plan, update it by March 1 each year, and keep the plan and each update on site at your business office.
• Submit a Certification Letter to the Public Utility Division Director by March 1 each year, and whenever a change is made, certifying whether you have a security plan and whether you are seeking cost recovery.
• The subchapter also states that a utility is not otherwise required to comply with its provisions beyond submitting the Certification Letter and having the plan reviewed, and the letter may certify that you have no plan and are not seeking cost recovery, so check with the Division how the framework and plan duties apply to you.

OAC 165:45-21, gas utility homeland security and critical infrastructure rules · Read the law's page

• This binds a gas utility serving Oklahoma jurisdictional ratepayers under the Corporation Commission's rules, which you declare by stating that you operate an essential service.
• Follow the most current applicable United States Department of Transportation, Office of Pipeline Safety's "Pipeline Security Information Circular" and "Pipeline Security Contingency Plan Guidance" or an equivalent cybersecurity framework as guidelines for protecting your critical infrastructure from extended service interruption.
• Prepare and make available for inspection a Homeland Security and Critical Infrastructure Plan, marked Highly Sensitive Confidential, that designates your critical infrastructure facilities, sets out the measures to secure them and follows that framework with a defined cybersecurity strategy.
• If you seek to recover security costs from Oklahoma jurisdictional ratepayers outside a general rate review, develop, implement and maintain a Critical Infrastructure and Security Plan, update it by March 1 each year, and keep the plan and each update on site at your business office.
• Submit a Certification Letter to the Public Utility Division Director by March 1 each year, and whenever a change is made, certifying whether you have a security plan and whether you are seeking cost recovery.
• The subchapter also states that a utility is not otherwise required to comply with its provisions beyond submitting the Certification Letter and having the plan reviewed, and the letter may certify that you have no plan and are not seeking cost recovery, so check with the Division how the framework and plan duties apply to you.

OAC 165:35-33-7(c), electric utility cybersecurity event reporting · Read the law's page

• This binds a an electric utility serving Oklahoma customers under the Corporation Commission's rules, which you declare by stating that you operate an essential service.
• Report cybersecurity or infrastructure security events that affect customers immediately to the Public Utility Division Director and his or her designee.
• The subchapter that contains this duty states that a utility is not otherwise required to comply with its provisions beyond the Certification Letter and review provisions, so check with the Division how the immediate-report duty applies to you.

OAC 165:45-21-7(c), gas utility cybersecurity event reporting · Read the law's page

• This binds a a gas utility serving Oklahoma customers under the Corporation Commission's rules, which you declare by stating that you operate an essential service.
• Report cybersecurity or infrastructure security events that affect customers immediately to the Public Utility Division Director or designee.
• The subchapter that contains this duty states that a utility is not otherwise required to comply with its provisions beyond the Certification Letter and review provisions, so check with the Division how the immediate-report duty applies to you.

OAC 165:65-9-2(4), water utility cybersecurity event reporting · Read the law's page

• This binds a a water utility serving Oklahoma customers under the Corporation Commission's rules, which you declare by stating that you operate an essential service.
• Report cybersecurity or infrastructure security events that affect customers immediately to the Public Utility Division Director or designee.