Ontario Cyber Security Standard, report of a confirmed cyber security incident to the IESO by the end of the next business day
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Enforcement body
- Ontario Energy Board
- Obligation class
- Reporting
As of .
What it requires
- It reaches you if you declare that you operate an essential service and you hold an Ontario electricity transmitter or distributor licence, because compliance with the Transmission System Code and the Distribution System Code is a licence condition.
- Notify the IESO of a confirmed cyber security incident by submitting a Cyber Security Incident Report through the Lighthouse Member Portal or to cybersecurity@ieso.ca by the end of the next business day after you confirm the incident (part 6.1 and Appendix 2).
- Complete the four questions on the report that decide whether it is a Notable Cyber Security Incident Report, which the IESO shares with the Ontario Energy Board (part 6.2).
- Submit a revised report by the end of the next business day after you learn new information that materially alters a report you already submitted (part 6.3).
- Answer an information request from the IESO or the Ontario Energy Board about the incident, including your security controls, processes and risks, within the timeline stated in the request (part 6.4).
These lines are LexLint's reading of the law's text, as of .
What this law does
A transmitter or distributor shall notify the IESO of a cyber security incident involving it by submitting a cyber security incident report to the IESO by the end of the next business day following the confirmation that a cyber security incident has occurred.
A cyber security incident is a confirmed, intentional, successful, and unauthorized action to gain access to, modify, destroy, delete, or render unavailable information or any information technology or operating technology network or system that is owned, operated or used by the transmitter or distributor.
A transmitter or distributor shall complete the four questions that determine whether a report is a notable cyber security incident report, and the IESO shares notable reports with the Ontario Energy Board in accordance with its licence requirements.
Where a transmitter or distributor becomes aware of new information that materially alters the content of a submitted report, it shall submit a revised report to the IESO by the end of the next business day following the receipt of the new information.
A transmitter or distributor shall respond to an information request by the IESO or the Ontario Energy Board related to a cyber security incident, including about its security controls, processes and risks, within the timeline stated at the time of the request. The Ontario Energy Board's version 3.0 of the Standard requires licensed electricity distributors and transmitters to report cyber security incidents to the Independent Electricity System Operator starting .
When LexLint raises it
When your app profile says your app runs an essential service.