Ontario Cyber Security Standard, Lighthouse participation, framework control objectives and independent assessment, given force by the Transmission and Distribution System Codes
In force since .
A sector security regimes rule binding public and private bodies.
- Enforcement body
- Ontario Energy Board
- Obligation class
- Security, Governance
As of .
What it requires
- It reaches you if you declare that you operate an essential service and you hold an Ontario electricity transmitter or distributor licence, because compliance with the Transmission System Code and the Distribution System Code is a licence condition.
- Participate in the IESO's Lighthouse service: sign the IESO's participation agreement, be granted access to the Lighthouse Member Portal and establish a secure network connection with the Lighthouse infrastructure, and confirm your participation as the Ontario Energy Board requires (part 3).
- Implement the Cyber Security Framework control objectives that part 4.1 lists at maturity indicator level 2 and those that part 4.2 lists, and report on their implementation (part 4).
- Obtain an independent assessment on the schedule the Ontario Energy Board sets, from an independent assessor who meets the minimum qualifications in part 5.1 (a), and have the assessor assess your maturity indicator level for each control objective (part 5.1).
- Have the assessor and your Chief Executive Officer sign and date the assessment report, and submit it to the Ontario Energy Board signed by the Chief Executive Officer on or before the reporting deadline (part 5.1 (c) and (d)).
- If the Ontario Energy Board requires it after reviewing the report, submit an action plan with the steps you intend to take on the recommendations, including target maturity levels and timelines (part 5.2).
These lines are LexLint's reading of the law's text, as of .
What this law does
The provisions of the Ontario Cyber Security Standard are given force by requirements of section 3B.2.4 of the Transmission System Code and section 6.8.3 of the Distribution System Code. Compliance with those codes is a condition of the Ontario Energy Board's electricity transmitter and electricity distributor licences, respectively. The Standard's original effective date is , and version 3.1 of it was issued on .
A transmitter or distributor shall participate in the IESO's Lighthouse service and will confirm its participation as required by the Ontario Energy Board. A transmitter or distributor shall implement the listed Cyber Security Framework control objectives at maturity indicator level 2 and report on their implementation. A transmitter or distributor shall obtain an independent assessment in accordance with the schedule the Ontario Energy Board determines from time to time.
A transmitter or distributor shall submit the completed independent assessment report to the Ontario Energy Board, signed by its Chief Executive Officer, on or before the reporting deadline the Board establishes. Following the review of a report, the Ontario Energy Board may require a transmitter or distributor to submit an action plan providing the steps it intends to take.
When LexLint raises it
When your app profile says your app runs an essential service.