Law / United States / 
Georgia
Georgia Cyber Attack Reporting by Utilities
Cyber Attack Reporting by Utilities, O.C.G.A. s. 38-3-22.2(c)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every utility, meaning any publicly, privately or cooperatively owned line, facility or system for producing, transmitting or distributing power, electricity, light, heat or gas (reached by declaring that you operate an essential service) (O.C.G.A. 38-3-22.2(a)(2)).
- Report to the director of emergency management and homeland security, or the director's designee, any cyber attack incident, data breach or identified use of malware on a utility computer or network, as that information is required to be reported to the United States government or any agency of it (O.C.G.A. 38-3-22.2(c)).
- Within two hours of making that federal report, provide substantially the same information to the director or the director's designee (O.C.G.A. 38-3-22.2(c)).
- Where federal law, rule or regulation prohibits the information from being disseminated, provide it to the director when the prohibition expires or is lifted (O.C.G.A. 38-3-22.2(c)).
- Notify any person impacted by the incident wherever other law, including Article 34 of Chapter 1 of Title 10, requires it, because this Code section does not relieve you of that duty (O.C.G.A. 38-3-22.2(e)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 38-3-22.2(c) requires every utility to report to the director of emergency management and homeland security, or the director's designee, any cyber attack incident, data breach, or identified use of malware on a utility computer or network as such information is required to be reported to the United States government or any agency of it.
Within two hours of making that report to the United States government or any agency of it, the utility must provide substantially the same information to the director or the director's designee. If federal law, rule, or regulation prohibits the information from being disseminated, the utility must provide it upon the expiration or lifting of the prohibition.
A utility is any publicly, privately, or cooperatively owned line, facility, or system for producing, transmitting, or distributing power, electricity, light, heat, or gas. Reports or records produced under section 38-3-22.2 are not subject to public inspection or disclosure under Article 4 of Chapter 18 of Title 50.
Nothing in section 38-3-22.2 relieves an agency or utility of any duty that may exist under law to notify any person impacted by a cyber attack incident, data breach, or identified use of malware. The Act that added section 38-3-22.2 became effective upon its approval by the Governor or upon its becoming law without such approval. Governor Brian Kemp signed House Bill 156 into law on .
When LexLint raises it
When your app profile says your app runs an essential service.