Duty LXD-7189
Runs an essential service, in Tennessee
Utility cyber security plans: public utilities regulated by the Tennessee Public Utility Commissionsince 4 lines
Public Chapter 1111 (2022), Tenn. Code Ann. sec. 65-4-127 · Read the law's page
- This binds a public utility that provides electric, water, wastewater, or natural gas services and is regulated by the Tennessee Public Utility Commission (reached by declaring that you operate an essential service). Municipal and cooperative utilities fall under a separate part of the Code.
- Prepare and implement a cyber security plan to provide for the protection of the utility's facilities from unauthorized use, alteration, ransom, or destruction of electronic data, by or within one year after the utility is formed, whichever is later.
- Assess and update the plan no less frequently than once every two years to address new threats.
- By July 1 each year, submit documentation of the utility's compliance to the Commission, in writing and under oath by the chief executive officer, president, or other person with an equivalent role. The Commission's rule -.04 requires the filing to include contact information for the employees responsible for cybersecurity, a statement whether annual cybersecurity training is conducted, and a statement whether cybersecurity insurance has been procured.
Utility cyber security plans: water and wastewater, cooperative, and county or municipal utilitiessince 2 lines
Public Chapter 1111 (2022), Tenn. Code Ann. title 7, chapter 51, part 22 (secs. 7-51-2201 to 7-51-2205) · Read the law's page
- Prepare and implement a cyber security plan to provide for the protection of the utility's facilities from unauthorized use, alteration, ransom, or destruction of electronic data, by or within one year after the utility is formed, whichever is later.
- Assess and update the cyber security plan every two years to address new threats.
- This binds an entity subject to the jurisdiction of the water and wastewater financing board or the utility management review board, a cooperative, or a county-owned or municipal-owned utility that provides electric, natural gas, or propane services to the public (reached by declaring that you operate an essential service).
Utility cybersecurity incident notification to the Tennessee Public Utility Commissionsince 3 lines
Tennessee Public Utility Commission Rule -.06, adopted under Tenn. Code Ann. sec. 65-4-127 · Read the law's page
- This binds a public utility that provides electric, water, wastewater, or natural gas services and is regulated by the Tennessee Public Utility Commission (reached by declaring that you operate an essential service).
- Electronically notify the Commission's Executive Director of any cybersecurity incident that results in interruption of service within 72 hours after discovery and confirmation.
- Unless law enforcement prohibits or recommends against notice to avoid compromising an investigation, notify on that clock; where it does, notify within 24 hours after the restriction is lifted by law enforcement.