Alberta Reliability Standard CIP-008-AB-5, cyber security incident reporting and response planning
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Governance
As of .
What it requires
- If you are a Responsible Entity listed in section 4.1, such as the operator or legal owner of a generating unit or of a transmission facility, document one or more cyber security incident response plans for your high impact and medium impact BES cyber systems that include a process to identify, classify and respond to cyber security incidents, the roles and responsibilities of response groups or individuals, and incident handling procedures (R1, Table R1 parts 1.1, 1.3 and 1.4).
- Include in each plan a process to determine whether an identified incident is a reportable cyber security incident and to notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law, with an initial notice, which may be only a preliminary notice, no more than one hour after you determine that it is reportable (R1, Table R1 part 1.2).
- Test each plan at least once every 15 months, by responding to an actual reportable incident, a paper drill or tabletop exercise, or an operational exercise, and retain records related to a reportable cyber security incident (R2, Table R2 parts 2.1 and 2.3).
- No later than 90 days after a test or an actual reportable incident response, document the lessons learned or the absence of any, update the plan and notify each person or group with a defined role in it (R3, Table R3 part 3.1).
These lines are LexLint's reading of the law's text, as of .
What this law does
The standard applies to the operator and the legal owner of a generating unit and of an aggregated generating facility. It also applies to the legal owner of a transmission facility and to the ISO. Each Responsible Entity shall document one or more cyber security incident response plans.
A plan must include one or more processes to determine whether an identified cyber security incident is a reportable cyber security incident and to notify the Electricity Sector Information Sharing and Analysis Center, unless prohibited by law. The initial notification, which may be only a preliminary notice, shall not exceed one hour from the determination of a reportable cyber security incident. Each plan must be tested at least once every 15 months.
No later than 90 days after a test or an actual reportable incident response, the entity must document any lessons learned or the absence of any. The standard was released on . The Alberta Electric System Operator lists it as a current Alberta reliability standard.
When LexLint raises it
When your app profile says your app runs an essential service.