Duty LXD-7190
Runs an essential service, in Utah
Safe Drinking Water Act, emergency response plan with cybersecurity measures for a community water systemsince 4 lines
Utah Code 19-4-117(2) · Read the law's page
- Applies to a supplier of a community water system; declare operates_essential_service where you operate such a system.
- Complete an emergency response plan by , and by July 1 annually thereafter if the system serves a population of 3,300 or greater, or by , and annually thereafter if it serves fewer than 3,300; report to the division on or before July 1 of each year whether the plan is complete.
- Include in the plan a requirement to support and regularly update software used in a control system, deploy and maintain network protection for a control system as needed, adopt best practices for secure authentication, provide annual cybersecurity training to an employee who has regular access to an operational technology or control system, complete an internal assessment of security vulnerabilities and implement corrective controls, remove access to operational technology and control systems promptly from a terminated employee, and ensure an automated operational technology or control system can be operated manually.
- Make the plan, any incident report and any related information available to the director on request, and comply with a security directive by the director.
Safe Drinking Water Act, report of a security breach at a community water systemsince 2 lines
Utah Code 19-4-117(3) · Read the law's page
- Applies to a supplier of a community water system; declare operates_essential_service where you operate such a system.
- Report a security breach to the Utah Cyber Center no later than two hours after you discover it. A security breach is an incident that threatens the security of the community water system with the potential to impact the quality or quantity of delivered water, and includes a breach of an operational technology or control system and an unauthorized attempt to delete, disable, destroy or override data, an application, a device or a computer network.